Get Seed from BazarBackdoor Domain

Enter a BazarBackdoor domain, for example: bcfhjkbhhhjm.bazar. See this blog post for more information. The form also handles the buggy version of the DGA with tld .bazaar and the newer version.

Convert A-Records

BazarBackdoor XOR transforms each resolved IP with ``0xFE``. You can use this form to calculate the real IP from an A record, or to get the IP you need to set when sinkholing. For example, the A RR 62.157.1.222 of a BazarBackdoor domain will be transformed by the malware into the real C2 address 192.99.255.32. Similarly, in order to point the malware to 127.0.0.1 when sinkholing, the A RR needs to be 129.254.254.255