This is where the McAfee Labs Threat Center entered the story. McAfee’s global sensor network had already flagged the DGA algorithm used by this specific malware family. They didn't know the exact domain the malware would generate, but they knew the pattern .
What McAfee Labs (and similar services) typically report www.xxhxx.com - domain - mcafee labs threat center