1. A system for an online platform implementing an analytics framework for domain detection on passive DNS traffic, comprising: a processor configured to: receive a DNS data stream; process the DNS data stream to identify a bad network domain based on a behavioral analysis model applied to a time series collection of passive DNS traffic data, wherein the behavioral analysis model is determined based at least in part on a loyalty value of a plurality of DNS messages and an entropy of resolved IP addresses related to the plurality of DNS messages, wherein the loyalty value is determined based at least in part on: an average time to live (TTL) of the plurality of DNS messages; a number of messages of a set of consecutive DNS messages collected against a fully qualified domain name (FQDN); a number of unique resolved IP addresses from the set of consecutive DNS messages over a period of time; a number of resolved IP addresses relating to DNS responses associated with the set of consecutive DNS messages; and a frequency of reuse of a target IP address, the loyalty value being higher in the event that the frequency of reuse of the target IP address is higher; perform a mitigation action based on the identified bad network domain; determine a host is infected based on detecting a DNS query request to the bad network domain from the host; and perform another mitigation action based on the determined infected host; and a memory coupled to the processor and configured to provide the processor with instructions.