#############################################################
## Manual Page for the Banjori DGA
##
## Feed Provided By: John Bambenek of Bambenek Consulting
## jcb@bambenekconsulting.com // http://bambenekconsulting.com
##
#############################################################

FALSE POSITIVE RISK: Low

See feed formats descriptions here:
http://osint.bambenekconsulting.com/manual/feedformats.txt

This DGA is used by the Banjori banking trojan and is no 
longer in apparent use.

This DGA takes a domain name as a seed and then generates
up to 15,373 domains from there. It is not date-dependent
and generates domains between 12 and 27 characters excluding
tld.

These feeds are generated every 60 minutes with a 3 hour lookback.

Reference:
https://www.johannesbader.ch/2015/02/the-dga-of-banjori/