SANS Hunting on the Cheap
RandomForest using domain features like vowel_to_consonant_ratio, longest_consonant_sequence, ngrams from dictionary and alexa top domains.