From 9991b68c5b86e93c5fc89178258cc627c0a2b1b8 Mon Sep 17 00:00:00 2001
From: Johannes Bader <baderj@gmx.net>
Date: Tue, 12 Nov 2019 00:52:16 +0100
Subject: [PATCH] added second version

---
 qsnatch/{dga.py => dga_a.py}                  |    0
 qsnatch/dga_b.py                              |   45 +
 ...mple_domains.txt => example_domains_a.txt} | 1740 ++++++++---------
 qsnatch/example_domains_b.txt                 |  150 ++
 4 files changed, 1065 insertions(+), 870 deletions(-)
 rename qsnatch/{dga.py => dga_a.py} (100%)
 create mode 100644 qsnatch/dga_b.py
 rename qsnatch/{example_domains.txt => example_domains_a.txt} (67%)
 create mode 100644 qsnatch/example_domains_b.txt

diff --git a/qsnatch/dga.py b/qsnatch/dga_a.py
similarity index 100%
rename from qsnatch/dga.py
rename to qsnatch/dga_a.py
diff --git a/qsnatch/dga_b.py b/qsnatch/dga_b.py
new file mode 100644
index 0000000..889011f
--- /dev/null
+++ b/qsnatch/dga_b.py
@@ -0,0 +1,45 @@
+import time
+import hashlib
+import base64
+import argparse
+from datetime import datetime
+
+
+TLDS =['cf', 'tk', 'ml', 'ga', 'gq', 'com', 'biz', 'org', 'de', 'rocks', 'mx', 'cn', 'top', 'nl', 'men', 'ws', 'se', 'info', 'xyz', 'net', 'today', 'ru', 'fi', 'name', 'to', 'in', 'com.ua', 'vg', 'vn', 'cd']
+SEED = "IbjGOEgnuD"
+
+
+def dga(date):
+    def unix(date):
+        unix = int(time.mktime(date.timetuple()))
+        return unix
+
+    HOUR = 3600
+    DAY = 24*HOUR
+    INTERVAL = 15*DAY
+    for tld in TLDS:
+        key = f"{unix(date)//INTERVAL}{SEED}{tld}\n".encode('ascii')
+        key_hash = hashlib.sha1(key).digest()
+        key_hash_b64 = base64.b64encode(key_hash).decode('ascii')
+        key_hash_b64_noeq_lc = key_hash_b64.rstrip("=").lower()
+        trantab = str.maketrans("-+/", "abc")
+        hostname_src = key_hash_b64_noeq_lc.translate(trantab)
+        for hostname_len in range(6, 11):
+            hostname = hostname_src[:hostname_len]
+            domain = f"{hostname}.{tld}"
+            yield domain
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="QSnatch dga")
+    parser.add_argument(
+        "-d", "--datetime",
+        help="date time for which to generate domains, e.g., "
+             "2019-11-11 18:00:00")
+    args = parser.parse_args()
+    if args.datetime:
+        d = datetime.strptime(args.datetime, "%Y-%m-%d %H:%M:%S")
+    else:
+        d = datetime.now()
+    for domain in dga(d):
+        print(domain)
diff --git a/qsnatch/example_domains.txt b/qsnatch/example_domains_a.txt
similarity index 67%
rename from qsnatch/example_domains.txt
rename to qsnatch/example_domains_a.txt
index 4f66087..4ea8f3b 100644
--- a/qsnatch/example_domains.txt
+++ b/qsnatch/example_domains_a.txt
@@ -1738,873 +1738,873 @@ la8q.com.gu
 i4nl..com.bn
 8dh9.com.pf
 pygx.com.fj
-okptd.cf
-ozfbs.tk
-vomrxh.com
-4f5ek.ml
-xstug.de
-lbubb.rocks
-q08bd.mx
-yuzpy.biz
-nl8wcr.net
-7b3bc.cn
-lgp7k.ga
-bl4ww.gq
-zhfjg9.org
-rekuo.top
-izrwh.nl
-agqrw.men
-ocacc.ws
-34xst.se
-dfhkj.info
-buhey.xyz
-yjqr8.today
-geyyv.ru
-5lvny.ec
-txkpz.co
-tdqbv.ee
-jwgcc.rs
-5k9r2.com.sv
-ouiym.com.cy
-ulgu8.co.zw
-vf06b.kg
-kmph6.com.ge
-vfil0.tl
-htpfm.name
-wrzxn.tw
-gzvbb.lv
-c0wpk.bs
-rb6oq.li
-hsnmi.ng
-pabza.ae
-m8jkr.bt
-iqtpb.tv
-cauvu.pe
-bpf7q.uz
-51xdw.me
-f41oi.gy
-lxzoj.am
-8cwzc.kr
-dhxou.by
-tqe2s.fr
-tbumh.com.uy
-oxvr1.com.lb
-bwnag.com.br
-nxgzs.vu
-bpdbi.hk
-i7tfs.in
-cxgga.re
-bewte.ch
-56sxb.af
-zdxxq.com.ps
-q1pni.ug
-jxnvy.dz
-ka0u8.pro
-1kpzi.co.th
-ahqca.sg
-vnbnu.cd
-igtys.so
-iyque.mo
-mt2ig.co.id
-subd1.co.il
-20ae8.com.do
-sdmnl.ke
-g7m46.cx
-jafbv.ro
-hrb2k.id
-rlnpf.pm
-bm6sz.hm
-nrbho.vg
-tfhpy.az
-wrnbh.com.eg
-fmi1t.bz
-i2lxq.su
-uf3mx.com.ar
-kr4gl.gg
-f5gsl.com.lr
-jg3q1.pa
-qwldx.com.ve
-72cb4.al
-mr9dk.fm
-zs3v6.to
-sbknr.mu
-hpl9x.co.ck
-svihe.pk
-unyhb.co.rs
-ryoa9.cw
-6qfsy.nr
-w9ti2.gd
-zzjhg.gl
-6vvkj.ac
-mdh9j.lk
-fgpnw.md
-crftp.fi
-6glze.sx
-obr5g.lc
-eg50b.es
-cr2ys.cc
-2hs4o.cm
-eehn2.la
-1ul7c.co.za
-9zxwq.je
-l9j9g.cz
-egy3b.jp
-bf9hp.ai
-3qgtw.pw
-hc1nw.bg
-rhpts.nu
-vv4bp.ag
-7rtq8.bm
-uens1.eu
-uom5t.com.my
-3ohbs.sc
-eekns.ax
-vvlo3.wf
-cf7ek.ly
-o0uqu.qa
-byx0s.vn
-hxccb.aq
-0xbnp.mobi
-s0kcm.com.tr
-bouuq.com.ua
-munl3.com.py
-meygu.hk.org
-0xiy3.south.am
-qygjr.com.kh
-yls79.co.zm
-hatii.ru.net
-o5tvb.com.km
-obj8w.tt
-88auw.kn
-brio3.co.ls
-k9bhi.co.fk
-tdzip.uy.com
-koyr3.com.gu
-jbcuo..com.bn
-nbuxk.com.pf
-5cuk6.com.fj
-okp.cf
-ozf.tk
-vomr.com
-4f5.ml
-xst.de
-lbu.rocks
-q08.mx
-yuz.biz
-nl8w.net
-7b3.cn
-lgp.ga
-bl4.gq
-zhfj.org
-rek.top
-izr.nl
-agq.men
-oca.ws
-34x.se
-dfh.info
-buh.xyz
-yjq.today
-gey.ru
-5lv.ec
-txk.co
-tdq.ee
-jwg.rs
-5k9.com.sv
-oui.com.cy
-ulg.co.zw
-vf0.kg
-kmp.com.ge
-vfi.tl
-htp.name
-wrz.tw
-gzv.lv
-c0w.bs
-rb6.li
-hsn.ng
-pab.ae
-m8j.bt
-iqt.tv
-cau.pe
-bpf.uz
-51x.me
-f41.gy
-lxz.am
-8cw.kr
-dhx.by
-tqe.fr
-tbu.com.uy
-oxv.com.lb
-bwn.com.br
-nxg.vu
-bpd.hk
-i7t.in
-cxg.re
-bew.ch
-56s.af
-zdx.com.ps
-q1p.ug
-jxn.dz
-ka0.pro
-1kp.co.th
-ahq.sg
-vnb.cd
-igt.so
-iyq.mo
-mt2.co.id
-sub.co.il
-20a.com.do
-sdm.ke
-g7m.cx
-jaf.ro
-hrb.id
-rln.pm
-bm6.hm
-nrb.vg
-tfh.az
-wrn.com.eg
-fmi.bz
-i2l.su
-uf3.com.ar
-kr4.gg
-f5g.com.lr
-jg3.pa
-qwl.com.ve
-72c.al
-mr9.fm
-zs3.to
-sbk.mu
-hpl.co.ck
-svi.pk
-uny.co.rs
-ryo.cw
-6qf.nr
-w9t.gd
-zzj.gl
-6vv.ac
-mdh.lk
-fgp.md
-crf.fi
-6gl.sx
-obr.lc
-eg5.es
-cr2.cc
-2hs.cm
-eeh.la
-1ul.co.za
-9zx.je
-l9j.cz
-egy.jp
-bf9.ai
-3qg.pw
-hc1.bg
-rhp.nu
-vv4.ag
-7rt.bm
-uen.eu
-uom.com.my
-3oh.sc
-eek.ax
-vvl.wf
-cf7.ly
-o0u.qa
-byx.vn
-hxc.aq
-0xb.mobi
-s0k.com.tr
-bou.com.ua
-mun.com.py
-mey.hk.org
-0xi.south.am
-qyg.com.kh
-yls.co.zm
-hat.ru.net
-o5t.com.km
-obj.tt
-88a.kn
-bri.co.ls
-k9b.co.fk
-tdz.uy.com
-koy.com.gu
-jbc..com.bn
-nbu.com.pf
-5cu.com.fj
-okpt.cf
-ozfb.tk
-vomrx.com
-4f5e.ml
-xstu.de
-lbub.rocks
-q08b.mx
-yuzp.biz
-nl8wc.net
-7b3b.cn
-lgp7.ga
-bl4w.gq
-zhfjg.org
-reku.top
-izrw.nl
-agqr.men
-ocac.ws
-34xs.se
-dfhk.info
-buhe.xyz
-yjqr.today
-geyy.ru
-5lvn.ec
-txkp.co
-tdqb.ee
-jwgc.rs
-5k9r.com.sv
-ouiy.com.cy
-ulgu.co.zw
-vf06.kg
-kmph.com.ge
-vfil.tl
-htpf.name
-wrzx.tw
-gzvb.lv
-c0wp.bs
-rb6o.li
-hsnm.ng
-pabz.ae
-m8jk.bt
-iqtp.tv
-cauv.pe
-bpf7.uz
-51xd.me
-f41o.gy
-lxzo.am
-8cwz.kr
-dhxo.by
-tqe2.fr
-tbum.com.uy
-oxvr.com.lb
-bwna.com.br
-nxgz.vu
-bpdb.hk
-i7tf.in
-cxgg.re
-bewt.ch
-56sx.af
-zdxx.com.ps
-q1pn.ug
-jxnv.dz
-ka0u.pro
-1kpz.co.th
-ahqc.sg
-vnbn.cd
-igty.so
-iyqu.mo
-mt2i.co.id
-subd.co.il
-20ae.com.do
-sdmn.ke
-g7m4.cx
-jafb.ro
-hrb2.id
-rlnp.pm
-bm6s.hm
-nrbh.vg
-tfhp.az
-wrnb.com.eg
-fmi1.bz
-i2lx.su
-uf3m.com.ar
-kr4g.gg
-f5gs.com.lr
-jg3q.pa
-qwld.com.ve
-72cb.al
-mr9d.fm
-zs3v.to
-sbkn.mu
-hpl9.co.ck
-svih.pk
-unyh.co.rs
-ryoa.cw
-6qfs.nr
-w9ti.gd
-zzjh.gl
-6vvk.ac
-mdh9.lk
-fgpn.md
-crft.fi
-6glz.sx
-obr5.lc
-eg50.es
-cr2y.cc
-2hs4.cm
-eehn.la
-1ul7.co.za
-9zxw.je
-l9j9.cz
-egy3.jp
-bf9h.ai
-3qgt.pw
-hc1n.bg
-rhpt.nu
-vv4b.ag
-7rtq.bm
-uens.eu
-uom5.com.my
-3ohb.sc
-eekn.ax
-vvlo.wf
-cf7e.ly
-o0uq.qa
-byx0.vn
-hxcc.aq
-0xbn.mobi
-s0kc.com.tr
-bouu.com.ua
-munl.com.py
-meyg.hk.org
-0xiy.south.am
-qygj.com.kh
-yls7.co.zm
-hati.ru.net
-o5tv.com.km
-obj8.tt
-88au.kn
-brio.co.ls
-k9bh.co.fk
-tdzi.uy.com
-koyr.com.gu
-jbcu..com.bn
-nbux.com.pf
-5cuk.com.fj
-bh67m.cf
-iqxyb.tk
-pniaxp.com
-fo3jg.ml
-sebbm.de
-blrhd.rocks
-vnrbt.mx
-0pjde.biz
-4rrhk5.net
-cuxdb.cn
-trrem.ga
-jt7nd.gq
-mjlazw.org
-ej4md.top
-hwf0b.nl
-nzqnl.men
-dizkv.ws
-dh8n9.se
-ffp9l.info
-spodx.xyz
-ukny3.today
-4sy5b.ru
-dxbbs.ec
-tvbjz.co
-ayabp.ee
-s5cee.rs
-ljxvi.com.sv
-2psrc.com.cy
-dwpgk.co.zw
-wji7s.kg
-2e5zn.com.ge
-qwadu.tl
-dzqu4.name
-cpblv.tw
-ldvoq.lv
-4v3yq.bs
-0xnbr.li
-rlsbx.ng
-yybr6.ae
-bw7pb.bt
-imbjv.tv
-wjn08.pe
-otsvc.uz
-qkcnk.me
-ugoja.gy
-xwtvm.am
-il995.kr
-14o6l.by
-p2ljq.fr
-kfthg.com.uy
-nls9y.com.lb
-qdmtg.com.br
-bcvhd.vu
-zbzvh.hk
-xgxyj.in
-htspt.re
-va7t9.ch
-hwzxy.af
-ewr9e.com.ps
-x5mch.ug
-gfxw8.dz
-ckkh5.pro
-llz5u.co.th
-ng6lp.sg
-l4jvf.cd
-q1r56.so
-z7ub8.mo
-c9z9x.co.id
-gyyrq.co.il
-lhgz5.com.do
-cvxng.ke
-zyc3p.cx
-qbf9r.ro
-abwbd.id
-oaqag.pm
-qfp0s.hm
-8dxvs.vg
-docou.az
-ckcvq.com.eg
-ymabe.bz
-a5sdf.su
-yi78g.com.ar
-tg7he.gg
-htbll.com.lr
-w7fm5.pa
-ozzt6.com.ve
-rbirb.al
-bmvko.fm
-h8inv.to
-4lzvz.mu
-tfgws.co.ck
-bt76c.pk
-pszvc.co.rs
-svcuy.cw
-ykip9.nr
-bzsg7.gd
-ls84d.gl
-ytiia.ac
-i53hf.lk
-doat9.md
-hqktl.fi
-vcx2f.sx
-oyz90.lc
-b7w6o.es
-rqmc3.cc
-lkpnu.cm
-tg9at.la
-p4xsv.co.za
-bccl3.je
-k3q5j.cz
-ucytj.jp
-db9rq.ai
-gqtlr.pw
-dvt5f.bg
-vs1yl.nu
-euwlv.ag
-scsbj.bm
-wbw5d.eu
-mclkr.com.my
-wuoki.sc
-bra4g.ax
-wclqn.wf
-rlcca.ly
-pb4xh.qa
-aepuj.vn
-dbbbb.aq
-mahrt.mobi
-yg2nf.com.tr
-l4wos.com.ua
-ffctg.com.py
-zzsbl.hk.org
-lkzka.south.am
-1ymur.com.kh
-gchsq.co.zm
-qxrv9.ru.net
-ifiqu.com.km
-sumul.tt
-nkrtk.kn
-e4add.co.ls
-irotu.co.fk
-qolcy.uy.com
-jsnhn.com.gu
-lteig..com.bn
-pzpyc.com.pf
-ghovg.com.fj
-bh6.cf
-iqx.tk
-pnia.com
-fo3.ml
-seb.de
-blr.rocks
-vnr.mx
-0pj.biz
-4rrh.net
-cux.cn
-trr.ga
-jt7.gq
-mjla.org
-ej4.top
-hwf.nl
-nzq.men
-diz.ws
-dh8.se
-ffp.info
-spo.xyz
-ukn.today
-4sy.ru
-dxb.ec
-tvb.co
-aya.ee
-s5c.rs
-ljx.com.sv
-2ps.com.cy
-dwp.co.zw
-wji.kg
-2e5.com.ge
-qwa.tl
-dzq.name
-cpb.tw
-ldv.lv
-4v3.bs
-0xn.li
-rls.ng
-yyb.ae
-bw7.bt
-imb.tv
-wjn.pe
-ots.uz
-qkc.me
-ugo.gy
-xwt.am
-il9.kr
-14o.by
-p2l.fr
-kft.com.uy
-nls.com.lb
-qdm.com.br
-bcv.vu
-zbz.hk
-xgx.in
-hts.re
-va7.ch
-hwz.af
-ewr.com.ps
-x5m.ug
-gfx.dz
-ckk.pro
-llz.co.th
-ng6.sg
-l4j.cd
-q1r.so
-z7u.mo
-c9z.co.id
-gyy.co.il
-lhg.com.do
-cvx.ke
-zyc.cx
-qbf.ro
-abw.id
-oaq.pm
-qfp.hm
-8dx.vg
-doc.az
-ckc.com.eg
-yma.bz
-a5s.su
-yi7.com.ar
-tg7.gg
-htb.com.lr
-w7f.pa
-ozz.com.ve
-rbi.al
-bmv.fm
-h8i.to
-4lz.mu
-tfg.co.ck
-bt7.pk
-psz.co.rs
-svc.cw
-yki.nr
-bzs.gd
-ls8.gl
-yti.ac
-i53.lk
-doa.md
-hqk.fi
-vcx.sx
-oyz.lc
-b7w.es
-rqm.cc
-lkp.cm
-tg9.la
-p4x.co.za
-bcc.je
-k3q.cz
-ucy.jp
-db9.ai
-gqt.pw
-dvt.bg
-vs1.nu
-euw.ag
-scs.bm
-wbw.eu
-mcl.com.my
-wuo.sc
-bra.ax
-wcl.wf
-rlc.ly
-pb4.qa
-aep.vn
-dbb.aq
-mah.mobi
-yg2.com.tr
-l4w.com.ua
-ffc.com.py
-zzs.hk.org
-lkz.south.am
-1ym.com.kh
-gch.co.zm
-qxr.ru.net
-ifi.com.km
-sum.tt
-nkr.kn
-e4a.co.ls
-iro.co.fk
-qol.uy.com
-jsn.com.gu
-lte..com.bn
-pzp.com.pf
-gho.com.fj
-bh67.cf
-iqxy.tk
-pniax.com
-fo3j.ml
-sebb.de
-blrh.rocks
-vnrb.mx
-0pjd.biz
-4rrhk.net
-cuxd.cn
-trre.ga
-jt7n.gq
-mjlaz.org
-ej4m.top
-hwf0.nl
-nzqn.men
-dizk.ws
-dh8n.se
-ffp9.info
-spod.xyz
-ukny.today
-4sy5.ru
-dxbb.ec
-tvbj.co
-ayab.ee
-s5ce.rs
-ljxv.com.sv
-2psr.com.cy
-dwpg.co.zw
-wji7.kg
-2e5z.com.ge
-qwad.tl
-dzqu.name
-cpbl.tw
-ldvo.lv
-4v3y.bs
-0xnb.li
-rlsb.ng
-yybr.ae
-bw7p.bt
-imbj.tv
-wjn0.pe
-otsv.uz
-qkcn.me
-ugoj.gy
-xwtv.am
-il99.kr
-14o6.by
-p2lj.fr
-kfth.com.uy
-nls9.com.lb
-qdmt.com.br
-bcvh.vu
-zbzv.hk
-xgxy.in
-htsp.re
-va7t.ch
-hwzx.af
-ewr9.com.ps
-x5mc.ug
-gfxw.dz
-ckkh.pro
-llz5.co.th
-ng6l.sg
-l4jv.cd
-q1r5.so
-z7ub.mo
-c9z9.co.id
-gyyr.co.il
-lhgz.com.do
-cvxn.ke
-zyc3.cx
-qbf9.ro
-abwb.id
-oaqa.pm
-qfp0.hm
-8dxv.vg
-doco.az
-ckcv.com.eg
-ymab.bz
-a5sd.su
-yi78.com.ar
-tg7h.gg
-htbl.com.lr
-w7fm.pa
-ozzt.com.ve
-rbir.al
-bmvk.fm
-h8in.to
-4lzv.mu
-tfgw.co.ck
-bt76.pk
-pszv.co.rs
-svcu.cw
-ykip.nr
-bzsg.gd
-ls84.gl
-ytii.ac
-i53h.lk
-doat.md
-hqkt.fi
-vcx2.sx
-oyz9.lc
-b7w6.es
-rqmc.cc
-lkpn.cm
-tg9a.la
-p4xs.co.za
-bccl.je
-k3q5.cz
-ucyt.jp
-db9r.ai
-gqtl.pw
-dvt5.bg
-vs1y.nu
-euwl.ag
-scsb.bm
-wbw5.eu
-mclk.com.my
-wuok.sc
-bra4.ax
-wclq.wf
-rlcc.ly
-pb4x.qa
-aepu.vn
-dbbb.aq
-mahr.mobi
-yg2n.com.tr
-l4wo.com.ua
-ffct.com.py
-zzsb.hk.org
-lkzk.south.am
-1ymu.com.kh
-gchs.co.zm
-qxrv.ru.net
-ifiq.com.km
-sumu.tt
-nkrt.kn
-e4ad.co.ls
-irot.co.fk
-qolc.uy.com
-jsnh.com.gu
-ltei..com.bn
-pzpy.com.pf
-ghov.com.fj
+dpzcr.cf
+iwjse.tk
+hmagb5.com
+up8yq.ml
+xirgp.de
+jvlwa.rocks
+uclzs.mx
+qgpxv.biz
+tqvo7y.net
+vopqp.cn
+aix8d.ga
+g7c1p.gq
+2whgtu.org
+xryf3.top
+hots4.nl
+p1til.men
+zco54.ws
+w5grb.se
+pq3l1.info
+hbywh.xyz
+0svxk.today
+3lqta.ru
+y30ah.ec
+3tdkn.co
+b5w32.ee
+mw0jw.rs
+0carv.com.sv
+ln3lw.com.cy
+yrmny.co.zw
+pbytr.kg
+zztqf.com.ge
+ma3ck.tl
+yujuh.name
+jbp4u.tw
+vn47b.lv
+yg06z.bs
+mcih3.li
+rvjrb.ng
+5zzjk.ae
+rxh9w.bt
+xbtnh.tv
+qbosi.pe
+sjmd9.uz
+zbojy.me
+jddjm.gy
+jmsug.am
+4fgwt.kr
+ocxhn.by
+zbgqm.fr
+lqkrm.com.uy
+ljgiw.com.lb
+w1jr7.com.br
+0nowc.vu
+qdoea.hk
+pzrmy.in
+o2iqu.re
+mzdhb.ch
+qklwv.af
+iz0oy.com.ps
+0wecs.ug
+yoaiq.dz
+evley.pro
+obn8d.co.th
+bo6ee.sg
+4mutc.cd
+7bbdu.so
+rgbdd.mo
+6tebe.co.id
+gvgu4.co.il
+ynyf2.com.do
+ecqpz.ke
+uvu5h.cx
+0e125.ro
+jbqgk.id
+maedc.pm
+entq2.hm
+v99h0.vg
+g47zh.az
+4arco.com.eg
+k0sk3.bz
+1g6wf.su
+zcupw.com.ar
+2lzqb.gg
+q17u0.com.lr
+1nhbn.pa
+ca00l.com.ve
+8eyml.al
+j8tev.fm
+ibayo.to
+2ifph.mu
+mj3in.co.ck
+rb2dj.pk
+to3ez.co.rs
+rpamw.cw
+k8qpm.nr
+o0s7d.gd
+pczko.gl
+kmoiw.ac
+u0lo2.lk
+k6jix.md
+kwbjl.fi
+gt8mn.sx
+o9btk.lc
+gtpzh.es
+rxvwy.cc
+sag6j.cm
+fq2lu.la
+bhqc4.co.za
+fi1bz.je
+3gx6l.cz
+kckxw.jp
+arww6.ai
+caiwq.pw
+bl02d.bg
+wyico.nu
+cacps.ag
+bg1y8.bm
+azuf6.eu
+0a9gy.com.my
+pcinw.sc
+d8yyj.ax
+qibck.wf
+5nmd8.ly
+1qihe.qa
+cplbb.vn
+vr2ho.aq
+ryrnw.mobi
+imsgc.com.tr
+qbqmc.com.ua
+xxzik.com.py
+1s8gj.hk.org
+bbxmp.south.am
+5k1p4.com.kh
+udavc.co.zm
+brpug.ru.net
+cvjpb.com.km
+vii8w.tt
+elub7.kn
+rxrhy.co.ls
+am8cm.co.fk
+zp7tr.uy.com
+51mvu.com.gu
+wuqnn..com.bn
+vbw8d.com.pf
+zpwm9.com.fj
+dpz.cf
+iwj.tk
+hmag.com
+up8.ml
+xir.de
+jvl.rocks
+ucl.mx
+qgp.biz
+tqvo.net
+vop.cn
+aix.ga
+g7c.gq
+2whg.org
+xry.top
+hot.nl
+p1t.men
+zco.ws
+w5g.se
+pq3.info
+hby.xyz
+0sv.today
+3lq.ru
+y30.ec
+3td.co
+b5w.ee
+mw0.rs
+0ca.com.sv
+ln3.com.cy
+yrm.co.zw
+pby.kg
+zzt.com.ge
+ma3.tl
+yuj.name
+jbp.tw
+vn4.lv
+yg0.bs
+mci.li
+rvj.ng
+5zz.ae
+rxh.bt
+xbt.tv
+qbo.pe
+sjm.uz
+zbo.me
+jdd.gy
+jms.am
+4fg.kr
+ocx.by
+zbg.fr
+lqk.com.uy
+ljg.com.lb
+w1j.com.br
+0no.vu
+qdo.hk
+pzr.in
+o2i.re
+mzd.ch
+qkl.af
+iz0.com.ps
+0we.ug
+yoa.dz
+evl.pro
+obn.co.th
+bo6.sg
+4mu.cd
+7bb.so
+rgb.mo
+6te.co.id
+gvg.co.il
+yny.com.do
+ecq.ke
+uvu.cx
+0e1.ro
+jbq.id
+mae.pm
+ent.hm
+v99.vg
+g47.az
+4ar.com.eg
+k0s.bz
+1g6.su
+zcu.com.ar
+2lz.gg
+q17.com.lr
+1nh.pa
+ca0.com.ve
+8ey.al
+j8t.fm
+iba.to
+2if.mu
+mj3.co.ck
+rb2.pk
+to3.co.rs
+rpa.cw
+k8q.nr
+o0s.gd
+pcz.gl
+kmo.ac
+u0l.lk
+k6j.md
+kwb.fi
+gt8.sx
+o9b.lc
+gtp.es
+rxv.cc
+sag.cm
+fq2.la
+bhq.co.za
+fi1.je
+3gx.cz
+kck.jp
+arw.ai
+cai.pw
+bl0.bg
+wyi.nu
+cac.ag
+bg1.bm
+azu.eu
+0a9.com.my
+pci.sc
+d8y.ax
+qib.wf
+5nm.ly
+1qi.qa
+cpl.vn
+vr2.aq
+ryr.mobi
+ims.com.tr
+qbq.com.ua
+xxz.com.py
+1s8.hk.org
+bbx.south.am
+5k1.com.kh
+uda.co.zm
+brp.ru.net
+cvj.com.km
+vii.tt
+elu.kn
+rxr.co.ls
+am8.co.fk
+zp7.uy.com
+51m.com.gu
+wuq..com.bn
+vbw.com.pf
+zpw.com.fj
+dpzc.cf
+iwjs.tk
+hmagb.com
+up8y.ml
+xirg.de
+jvlw.rocks
+uclz.mx
+qgpx.biz
+tqvo7.net
+vopq.cn
+aix8.ga
+g7c1.gq
+2whgt.org
+xryf.top
+hots.nl
+p1ti.men
+zco5.ws
+w5gr.se
+pq3l.info
+hbyw.xyz
+0svx.today
+3lqt.ru
+y30a.ec
+3tdk.co
+b5w3.ee
+mw0j.rs
+0car.com.sv
+ln3l.com.cy
+yrmn.co.zw
+pbyt.kg
+zztq.com.ge
+ma3c.tl
+yuju.name
+jbp4.tw
+vn47.lv
+yg06.bs
+mcih.li
+rvjr.ng
+5zzj.ae
+rxh9.bt
+xbtn.tv
+qbos.pe
+sjmd.uz
+zboj.me
+jddj.gy
+jmsu.am
+4fgw.kr
+ocxh.by
+zbgq.fr
+lqkr.com.uy
+ljgi.com.lb
+w1jr.com.br
+0now.vu
+qdoe.hk
+pzrm.in
+o2iq.re
+mzdh.ch
+qklw.af
+iz0o.com.ps
+0wec.ug
+yoai.dz
+evle.pro
+obn8.co.th
+bo6e.sg
+4mut.cd
+7bbd.so
+rgbd.mo
+6teb.co.id
+gvgu.co.il
+ynyf.com.do
+ecqp.ke
+uvu5.cx
+0e12.ro
+jbqg.id
+maed.pm
+entq.hm
+v99h.vg
+g47z.az
+4arc.com.eg
+k0sk.bz
+1g6w.su
+zcup.com.ar
+2lzq.gg
+q17u.com.lr
+1nhb.pa
+ca00.com.ve
+8eym.al
+j8te.fm
+ibay.to
+2ifp.mu
+mj3i.co.ck
+rb2d.pk
+to3e.co.rs
+rpam.cw
+k8qp.nr
+o0s7.gd
+pczk.gl
+kmoi.ac
+u0lo.lk
+k6ji.md
+kwbj.fi
+gt8m.sx
+o9bt.lc
+gtpz.es
+rxvw.cc
+sag6.cm
+fq2l.la
+bhqc.co.za
+fi1b.je
+3gx6.cz
+kckx.jp
+arww.ai
+caiw.pw
+bl02.bg
+wyic.nu
+cacp.ag
+bg1y.bm
+azuf.eu
+0a9g.com.my
+pcin.sc
+d8yy.ax
+qibc.wf
+5nmd.ly
+1qih.qa
+cplb.vn
+vr2h.aq
+ryrn.mobi
+imsg.com.tr
+qbqm.com.ua
+xxzi.com.py
+1s8g.hk.org
+bbxm.south.am
+5k1p.com.kh
+udav.co.zm
+brpu.ru.net
+cvjp.com.km
+vii8.tt
+elub.kn
+rxrh.co.ls
+am8c.co.fk
+zp7t.uy.com
+51mv.com.gu
+wuqn..com.bn
+vbw8.com.pf
+zpwm.com.fj
+n2u71.cf
+s54cm.tk
+bxhchw.com
+q5inj.ml
+rw0jg.de
+vkrgk.rocks
+bb8l3.mx
+blfjp.biz
+mcbaoe.net
+59p8t.cn
+ate9l.ga
+baoq6.gq
+ccexuz.org
+cwoq6.top
+gybe7.nl
+mctol.men
+95ni9.ws
+dkztt.se
+1xacu.info
+orl5q.xyz
+sidrc.today
+dewom.ru
+5r1aj.ec
+yemnl.co
+u3r1y.ee
+kj8on.rs
+0cmdp.com.sv
+ffdz1.com.cy
+ekbxp.co.zw
+qhztp.kg
+neu2i.com.ge
+tp9d5.tl
+a8pcj.name
+mrzjw.tw
+ymf1t.lv
+tjqrd.bs
+pbgzi.li
+aftmc.ng
+atw1b.ae
+wkuqy.bt
+gpiug.tv
+oku9s.pe
+mdkbc.uz
+6it4w.me
+rnwxh.gy
+drfzu.am
+gpsyk.kr
+ycf4k.by
+8kwcq.fr
+yqafr.com.uy
+qhmus.com.lb
+sniuc.com.br
+s7dgh.vu
+ctreo.hk
+tsj3f.in
+ovpwe.re
+xbj11.ch
+fpf3l.af
+am0d7.com.ps
+uvikm.ug
+ckxmm.dz
+9dq5y.pro
+fzcbp.co.th
+vtb5a.sg
+ledmw.cd
+wjz4o.so
+gsvtd.mo
+toj6c.co.id
+joxen.co.il
+yz3ks.com.do
+auhoc.ke
+qlpnm.cx
+wjmhz.ro
+hmzhc.id
+9iq1t.pm
+ocff5.hm
+2lnhb.vg
+mvmpb.az
+9drby.com.eg
+4mg8i.bz
+5imsf.su
+inwzo.com.ar
+cgilu.gg
+iazwf.com.lr
+rjrma.pa
+b3ips.com.ve
+f1ueo.al
+xrepk.fm
+2yvoi.to
+r7xxn.mu
+wwx0k.co.ck
+vbvpc.pk
+xias6.co.rs
+1ycbs.cw
+3dsyv.nr
+sw6l0.gd
+7eb80.gl
+dytdj.ac
+ijood.lk
+ccstv.md
+hfdac.fi
+bxkga.sx
+wyugs.lc
+afr2g.es
+lsb2u.cc
+laqpj.cm
+dlrsa.la
+h7flu.co.za
+jxz7b.je
+orcts.cz
+o8jb0.jp
+ysbw1.ai
+uc0kx.pw
+wr3no.bg
+n7nhw.nu
+e6rqc.ag
+ufcgv.bm
+b0tuz.eu
+hg23n.com.my
+fm7ck.sc
+7kwkx.ax
+exzgh.wf
+wwoac.ly
+parsz.qa
+obvsc.vn
+zuqxd.aq
+jh9yj.mobi
+vnnlm.com.tr
+nmit0.com.ua
+4biku.com.py
+dicdt.hk.org
+bl4um.south.am
+t5bdf.com.kh
+zco9h.co.zm
+p1r1y.ru.net
+4ricc.com.km
+vxeev.tt
+b3jik.kn
+xxkkh.co.ls
+1e7o7.co.fk
+2lnsj.uy.com
+8vvsw.com.gu
+d550q..com.bn
+42dys.com.pf
+lm9hu.com.fj
+n2u.cf
+s54.tk
+bxhc.com
+q5i.ml
+rw0.de
+vkr.rocks
+bb8.mx
+blf.biz
+mcba.net
+59p.cn
+ate.ga
+bao.gq
+ccex.org
+cwo.top
+gyb.nl
+mct.men
+95n.ws
+dkz.se
+1xa.info
+orl.xyz
+sid.today
+dew.ru
+5r1.ec
+yem.co
+u3r.ee
+kj8.rs
+0cm.com.sv
+ffd.com.cy
+ekb.co.zw
+qhz.kg
+neu.com.ge
+tp9.tl
+a8p.name
+mrz.tw
+ymf.lv
+tjq.bs
+pbg.li
+aft.ng
+atw.ae
+wku.bt
+gpi.tv
+oku.pe
+mdk.uz
+6it.me
+rnw.gy
+drf.am
+gps.kr
+ycf.by
+8kw.fr
+yqa.com.uy
+qhm.com.lb
+sni.com.br
+s7d.vu
+ctr.hk
+tsj.in
+ovp.re
+xbj.ch
+fpf.af
+am0.com.ps
+uvi.ug
+ckx.dz
+9dq.pro
+fzc.co.th
+vtb.sg
+led.cd
+wjz.so
+gsv.mo
+toj.co.id
+jox.co.il
+yz3.com.do
+auh.ke
+qlp.cx
+wjm.ro
+hmz.id
+9iq.pm
+ocf.hm
+2ln.vg
+mvm.az
+9dr.com.eg
+4mg.bz
+5im.su
+inw.com.ar
+cgi.gg
+iaz.com.lr
+rjr.pa
+b3i.com.ve
+f1u.al
+xre.fm
+2yv.to
+r7x.mu
+wwx.co.ck
+vbv.pk
+xia.co.rs
+1yc.cw
+3ds.nr
+sw6.gd
+7eb.gl
+dyt.ac
+ijo.lk
+ccs.md
+hfd.fi
+bxk.sx
+wyu.lc
+afr.es
+lsb.cc
+laq.cm
+dlr.la
+h7f.co.za
+jxz.je
+orc.cz
+o8j.jp
+ysb.ai
+uc0.pw
+wr3.bg
+n7n.nu
+e6r.ag
+ufc.bm
+b0t.eu
+hg2.com.my
+fm7.sc
+7kw.ax
+exz.wf
+wwo.ly
+par.qa
+obv.vn
+zuq.aq
+jh9.mobi
+vnn.com.tr
+nmi.com.ua
+4bi.com.py
+dic.hk.org
+bl4.south.am
+t5b.com.kh
+zco.co.zm
+p1r.ru.net
+4ri.com.km
+vxe.tt
+b3j.kn
+xxk.co.ls
+1e7.co.fk
+2ln.uy.com
+8vv.com.gu
+d55..com.bn
+42d.com.pf
+lm9.com.fj
+n2u7.cf
+s54c.tk
+bxhch.com
+q5in.ml
+rw0j.de
+vkrg.rocks
+bb8l.mx
+blfj.biz
+mcbao.net
+59p8.cn
+ate9.ga
+baoq.gq
+ccexu.org
+cwoq.top
+gybe.nl
+mcto.men
+95ni.ws
+dkzt.se
+1xac.info
+orl5.xyz
+sidr.today
+dewo.ru
+5r1a.ec
+yemn.co
+u3r1.ee
+kj8o.rs
+0cmd.com.sv
+ffdz.com.cy
+ekbx.co.zw
+qhzt.kg
+neu2.com.ge
+tp9d.tl
+a8pc.name
+mrzj.tw
+ymf1.lv
+tjqr.bs
+pbgz.li
+aftm.ng
+atw1.ae
+wkuq.bt
+gpiu.tv
+oku9.pe
+mdkb.uz
+6it4.me
+rnwx.gy
+drfz.am
+gpsy.kr
+ycf4.by
+8kwc.fr
+yqaf.com.uy
+qhmu.com.lb
+sniu.com.br
+s7dg.vu
+ctre.hk
+tsj3.in
+ovpw.re
+xbj1.ch
+fpf3.af
+am0d.com.ps
+uvik.ug
+ckxm.dz
+9dq5.pro
+fzcb.co.th
+vtb5.sg
+ledm.cd
+wjz4.so
+gsvt.mo
+toj6.co.id
+joxe.co.il
+yz3k.com.do
+auho.ke
+qlpn.cx
+wjmh.ro
+hmzh.id
+9iq1.pm
+ocff.hm
+2lnh.vg
+mvmp.az
+9drb.com.eg
+4mg8.bz
+5ims.su
+inwz.com.ar
+cgil.gg
+iazw.com.lr
+rjrm.pa
+b3ip.com.ve
+f1ue.al
+xrep.fm
+2yvo.to
+r7xx.mu
+wwx0.co.ck
+vbvp.pk
+xias.co.rs
+1ycb.cw
+3dsy.nr
+sw6l.gd
+7eb8.gl
+dytd.ac
+ijoo.lk
+ccst.md
+hfda.fi
+bxkg.sx
+wyug.lc
+afr2.es
+lsb2.cc
+laqp.cm
+dlrs.la
+h7fl.co.za
+jxz7.je
+orct.cz
+o8jb.jp
+ysbw.ai
+uc0k.pw
+wr3n.bg
+n7nh.nu
+e6rq.ag
+ufcg.bm
+b0tu.eu
+hg23.com.my
+fm7c.sc
+7kwk.ax
+exzg.wf
+wwoa.ly
+pars.qa
+obvs.vn
+zuqx.aq
+jh9y.mobi
+vnnl.com.tr
+nmit.com.ua
+4bik.com.py
+dicd.hk.org
+bl4u.south.am
+t5bd.com.kh
+zco9.co.zm
+p1r1.ru.net
+4ric.com.km
+vxee.tt
+b3ji.kn
+xxkk.co.ls
+1e7o.co.fk
+2lns.uy.com
+8vvs.com.gu
+d550..com.bn
+42dy.com.pf
+lm9h.com.fj
diff --git a/qsnatch/example_domains_b.txt b/qsnatch/example_domains_b.txt
new file mode 100644
index 0000000..76a9183
--- /dev/null
+++ b/qsnatch/example_domains_b.txt
@@ -0,0 +1,150 @@
+t2q2rs.cf
+t2q2rsa.cf
+t2q2rsaz.cf
+t2q2rsazo.cf
+t2q2rsazo1.cf
+gc9nzf.tk
+gc9nzfb.tk
+gc9nzfbt.tk
+gc9nzfbt3.tk
+gc9nzfbt3i.tk
+7ubqoy.ml
+7ubqoyq.ml
+7ubqoyqy.ml
+7ubqoyqyg.ml
+7ubqoyqygg.ml
+sp9j0y.ga
+sp9j0yl.ga
+sp9j0ylm.ga
+sp9j0ylmy.ga
+sp9j0ylmy0.ga
+ztfo59.gq
+ztfo59d.gq
+ztfo59du.gq
+ztfo59dum.gq
+ztfo59dumc.gq
+07tvvc.com
+07tvvct.com
+07tvvctq.com
+07tvvctqv.com
+07tvvctqv4.com
+nypnoo.biz
+nypnoo7.biz
+nypnoo7n.biz
+nypnoo7nc.biz
+nypnoo7ncd.biz
+6wxfzg.org
+6wxfzgr.org
+6wxfzgrp.org
+6wxfzgrpq.org
+6wxfzgrpq5.org
+53bcmf.de
+53bcmfu.de
+53bcmfuc.de
+53bcmfucw.de
+53bcmfucw2.de
+6zltft.rocks
+6zltftq.rocks
+6zltftqn.rocks
+6zltftqnj.rocks
+6zltftqnjo.rocks
+hv7uve.mx
+hv7uvev.mx
+hv7uvevp.mx
+hv7uvevps.mx
+hv7uvevpsu.mx
+rassbl.cn
+rassbl3.cn
+rassbl37.cn
+rassbl372.cn
+rassbl372g.cn
+3juvl2.top
+3juvl2o.top
+3juvl2om.top
+3juvl2omy.top
+3juvl2omyc.top
+45unmx.nl
+45unmxj.nl
+45unmxjo.nl
+45unmxjo3.nl
+45unmxjo3g.nl
+bbkqko.men
+bbkqkog.men
+bbkqkogw.men
+bbkqkogw1.men
+bbkqkogw1o.men
+4sxmt2.ws
+4sxmt2h.ws
+4sxmt2he.ws
+4sxmt2he8.ws
+4sxmt2he8w.ws
+lljech.se
+lljechu.se
+lljechuk.se
+lljechuk0.se
+lljechuk0n.se
+nhegcy.info
+nhegcym.info
+nhegcymn.info
+nhegcymnc.info
+nhegcymnco.info
+ykwuwv.xyz
+ykwuwvf.xyz
+ykwuwvff.xyz
+ykwuwvffd.xyz
+ykwuwvffdm.xyz
+qkzccy.net
+qkzccym.net
+qkzccymh.net
+qkzccymhh.net
+qkzccymhhd.net
+7h1f3p.today
+7h1f3pv.today
+7h1f3pve.today
+7h1f3pveb.today
+7h1f3pvebv.today
+hvo3uz.ru
+hvo3uzy.ru
+hvo3uzy9.ru
+hvo3uzy92.ru
+hvo3uzy92o.ru
+wpzecu.fi
+wpzecus.fi
+wpzecusq.fi
+wpzecusql.fi
+wpzecusqla.fi
+3k57lz.name
+3k57lzn.name
+3k57lzno.name
+3k57lznov.name
+3k57lznovv.name
+grtvef.to
+grtvef1.to
+grtvef1l.to
+grtvef1lc.to
+grtvef1lcq.to
+c14mpz.in
+c14mpzh.in
+c14mpzh1.in
+c14mpzh1i.in
+c14mpzh1iu.in
+vpc1td.com.ua
+vpc1td0.com.ua
+vpc1td0o.com.ua
+vpc1td0ox.com.ua
+vpc1td0oxc.com.ua
+kt1vzg.vg
+kt1vzgy.vg
+kt1vzgyd.vg
+kt1vzgydc.vg
+kt1vzgydci.vg
+aecomr.vn
+aecomrs.vn
+aecomrs5.vn
+aecomrs5h.vn
+aecomrs5hl.vn
+uqfzpr.cd
+uqfzpri.cd
+uqfzprih.cd
+uqfzprihe.cd
+uqfzpriheb.cd