You can deploy this model and start earning money today!

CalexisLabs/
codadns-domain-threat-scorer

Name: codadns-domain-threat-scorer
Availability: InStock

tabular-classification

apache-2.0

Views

No views yet

CodaDNS Domain Threat Scorer v2

A lightweight, self-contained model that scores a domain name (just the name — no network traffic, no page content) for lexical threat signals: DGA (algorithmically generated domains), typosquatting, and brand-impersonation phishing patterns. Built and used in production by CodaDNS, the family-focused DNS filtering service from Calexis Labs OÜ.

What it does

Input: a domain name string (e.g. paypal-secure-login.xyz). Output: a threat score from 0 to 100.

Example	Score
`google.com`	0.6
`wikipedia.org`	~3
`paypal-secure-login.xyz`	62.6
`xhovsrwxqhls.com` (DGA)	98.0

How it works

The domain is split into subdomain / registered label / public suffix using an embedded Public Suffix List snapshot.
~25 lexical features are extracted: character n-gram log-likelihood under a benign language model (the main DGA signal), entropy, dictionary word coverage, brand-keyword impersonation patterns (paypal.com.evil.tk), abused-TLD membership, and structure statistics.
A calibrated HistGradientBoostingClassifier (scikit-learn) maps the features to a probability, served as a 0–100 score.

The artifact is a single joblib dict containing the model, the n-gram language model, feature names, and a schema version. The feature extraction code (features.py, pure stdlib) ships alongside it.

Evaluation (measured 2026-07-12)

Evaluated on an apex-disjoint frozen holdout (no registered domain appears in both training and test — this matters, naive splits leak apex-level lexical patterns and inflate scores):

Metric	Value
Holdout AUC	0.892
DGA-subset AUC	0.981
DGA recall @ score 60	0.894
False-positive rate @ 60 (Tranco top-100K sample)	1.7%
Phishing recall @ 60	0.356
Inference latency	< 1 ms per domain

Honest limitations — read before using

This is a name-only triage model, not an antivirus. It cannot judge a lexically ordinary domain (imoblink.com) that hosts malicious content. In production we use it to decide which domains are worth sending to a verification service (VirusTotal); it never blocks on its own.
Phishing recall is limited by design: many phishing domains are lexically unremarkable. The model catches the obvious impersonation/DGA patterns.
The benign language model is trained on Tranco registered labels — domains in non-Latin-transcribed languages score somewhat higher on average. Calibrate thresholds for your traffic.
An adversary who knows the features can craft names that evade it (true of any lexical model). Use it as one layer, not the only layer.

Training data

Malicious: HuggingFace DGA and phishing corpora (label-filtered), Phishing.Army extended feed, VirusTotal-confirmed threats from CodaDNS production.
Benign: Tranco top-100K stratified sample, real allowed DNS traffic (aggregated, k≥2 users/days, capped per apex), VirusTotal-confirmed safe domains.
Both classes contain the same apex/FQDN structural mix (79%/79%) so the model cannot use domain structure as a class shortcut.

Usage

python

import joblib, sys
sys.path.insert(0, ".")          # features.py, psl_snapshot.dat, words_top5k.txt
from features import extract_features

artifact = joblib.load("threat_model.joblib")
model, ngram = artifact["model"], artifact["ngram_model"]

def score(domain: str) -> float:
    return model.predict_proba([extract_features(domain, ngram)])[0][1] * 100

print(score("paypal-secure-login.xyz"))   # ~62
print(score("google.com"))                # ~1

Requires scikit-learn>=1.6, joblib, numpy. features.py itself is pure stdlib.

Retraining

The full pipeline (dataset builder, trainer with a quality gate that refuses to publish a worse model, weekly retrain orchestration) is part of the CodaDNS codebase. The model is retrained weekly on refreshed feeds and accumulated verified labels.

CalexisLabs/codadns-domain-threat-scorer