1. A system for an online platform implementing an analytics framework for domain detection on passive DNS traffic, comprising: a processor configured to: receive a DNS data stream, the DNS data stream including a plurality of DNS messages related to a fully qualified domain name (FQDN); process the DNS data stream to identify a bad network domain based on a behavioral analysis model applied to a time series collection of passive DNS traffic data, wherein the behavioral analysis model is determined based at least in part on a loyalty value of the plurality of DNS messages and an entropy of resolved IP address related to the plurality of DNS messages, wherein: the loyalty value is determined based at least in part on: a number of resolved IP addresses relating to DNS responses associated with the plurality of DNS messages; a number of unique resolved IP addresses relating to the DNS responses; and an average time to live (TTL) of the plurality of DNS messages; and the entropy of the resolved IP addresses related to the plurality of DNS messages is determined based at least in part on a distribution of at least a first two octets of a unique resolved IP address; perform a mitigation action based on the bad network domain; determine a host is an infected host based on detecting a DNS query request to the bad network domain from the host; and perform another mitigation action based on the determined host; and a memory coupled to the processor and configured to provide the processor with instructions.