Question

What would indicate a suspicious hostname?

Answer 1

A system may receive strings from various sources, including but not limited to security feeds, DNS query feeds, etc. As an illustrative non-limiting example, a hostname may be suspicious if a DNS record of the hostname maps to another hostname that has already been predicted to be algorithmically generated.