victim systems. Being able to do this generally indicates the botnet operator has lost control of the domain, forgotten to renew it, or that the botnet has been abandoned. Another method focuses on reverse-engineering the