13. The apparatus of claim 8 , wherein the one or more processors are configured to identify additional domain names that use the infrastructure by identifying additional domain names that use a domain name server also used by one of the likely DGA domain names in the second pool.
8. An apparatus comprising: one or more processors; one or more memory devices in communication with the one or more processors; and a network interface unit in communication with the one or more processors, wherein the one or more processors are configured to: classify each one of first domain names as either a likely domain generation algorithm (DGA) domain name or a likely non-DGA domain name, based on evaluation of one or more features of the first domain names, producing a first pool of likely DGA domain names; determine statistics regarding requests for the likely DGA domain names in the first pool to identify a second pool of likely DGA domain names out of the first pool, wherein, for each of the likely DGA domain names in the second pool, the statistics of the requests indicate a spike over a period of time, where a number of the likely DGA domain names in the second pool is less than a number of the likely DGA domain names in the first pool; identify additional domain names that share an infrastructure with the likely DGA domain names in the second pool; and mitigate a security vulnerability related to one or more of the likely DGA domain names in the second pool and the additional domain names.