Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and/or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.

Some embodiments provide domain name suggestions based on a user-provided ASCII phrase translated and/or transliterated into any of a number of supported non-English language character sets. To suggest non-English-language domain names, some embodiments parse, translate, and transliterate the user-provided ASCII names into domain names that include at least one non-English language character. Moreover, some embodiments determine the DNS registration status (e.g., as a second-level domain) of the Punycode (in ASCII) corresponding to these non-English domain names and provide the user with the ability to register any that are unregistered.