## 1 Introduction  
Botnets consist of groups of computers or devices infected with malware, which can be remotely controlled via a command and control (C2) server [1]. Attackers leverage botnets for various cyberattacks, such as distributed denial of service (DDoS) attacks, directing infected devices to target specific systems, or systematically extracting information from corporate and government networks [2]. Botnets use Domain Generating Algorithms (DGAs) as a strategy to maintain and obfuscate communication between a botclient and C2 servers. DGAs are codes embedded in most malware families that generate domain names. These domains are used to maintain communication between the infected machines and the C2 servers [3, 4]. This approach allows the C2 servers to change their IP addresses without disrupting communication with the botnet. Consequently, DGAs enhance the resilience of communication between C2 servers and botnet members and improve the obfuscation of the C2 server's location [1]. Attackers register numerous domains that are compatible with their DGAs. This strategy ensures that if one domain is block-listed for abuse, another can take its place. The vast number of DGA-generated domains makes using block lists impractical, as maintaining a list of thousands of domains can significantly hinder firewall performance [5]. One of the most significant cyberattacks that used DGA at some point in its lifecycle was the attack on SolarWinds [6] that occurred in 2020. This gained notoriety when hackersmanaged to gain unauthorized access to the source code of the Orion system, which is used for monitoring technological infrastructure. More than 18,000 SolarWinds customers installed versions infected with the Sunburst malware, including technology giants such as Microsoft, Intel, and Cisco. The Sunburst malware used an elaborate DGA mechanism [3] that, in addition to maintaining communication between the infected station and the C2 servers, was also capable of accurately identifying which infected station the information obtained came from. Therefore, identifying requests for DGA domains on a network or detecting them during registration can mitigate botnet-related threats, prevent potential attacks on corporate networks, and support proactive cybersecurity measures. Approaches using deep neural networks have been used by researchers around the world to solve complex problems in a wide range of fields, from electrical engineering [7], to natural language processing and sentiment classification [8], and also in the area of cybersecurity. In this context, numerous efforts have been made to detect these DGAs through automated methods utilizing artificial intelligence, with the most recent approaches typically employing deep learning techniques. Ref. [9] use the NetLab360 dataset, which encompasses approximately 35 DGA families, for their analysis of DGA examples. They encode the input characters into values ranging from 0 to 38 to derive the initial feature vector. A Convolutional Neural Network (CNN) model, concatenated with a BiLSTM network, is proposed to extract meta-features for DGA detection. The study reports an accuracy of 94.51%, a recall of 95.05%, and a precision of 93.11% for binary detection. In [4], researchers utilize pre-trained word embedding models, including BERT [10] and ELMo [11], to generate the initial feature vector from domain names. This initial vector is input into a CNN and then processed by a classifier, achieving a peak accuracy of 96.08%. Ref. [12] presents a model based on CNN and character-level embeddings, utilizing domain names converted to ASCII as input. Using the Majestic Million [13] dataset for legitimate domain examples and the NetLab360 [14] dataset for examples from 56 threat families, the model achieves an accuracy of 99.12% and a precision of 99.33%. Considering the multitude of distinct threats, some recent efforts have concentrated on addressing the problem of classifying DGAs into families to ascertain the specific threat associated with a given DGA.