Systems and methods for detecting an attack on an auto-generated website by a virtual machine

A system for detecting an attack by a first virtual or physical machine on one or more auto-generated websites, the system comprising:

• a processor;
• a memory;
• and
• an application stored in the memory and including instructions, which are executable by the processor and that are configured to
• access an index of a search engine server computer and determine uniform resource locators (URLs) of a plurality of auto-generated websites, wherein the plurality of auto-generated websites include the one or more auto-generated websites;
• access a plurality of Internet protocol (IP) address-URL entries stored in a domain name system server computer;
• determine a first feature based on the URLs of the plurality of auto-generated websites and the IP address-URL entries, wherein the application, in determining the first feature, (i) determines which IP addresses in the IP address-URL entries are associated with hosting one of the plurality of auto-generated websites, and (ii) for each IP address in the IP address-URL entries, counts a number of corresponding URLs;
• collect header data of packets transmitted to or received from the first virtual or physical machine;
• determine a second feature based on the first feature and the header data;
• based on the second feature, generate a value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites;
• and
• perform a countermeasure based on the value.