Subdomain Flood

Mercur Retail LLP is a retail chain. The resolver administrator complained that load grew several-fold in one evening although nobody was in the office. The query export was handed to you.

What matters here is not the content of the names but their statistics. An ordinary workstation asks for a dozen familiar names an evening: mail, updates, the portal. Hundreds of different names inside one domain from a single machine is not a person.

The set contains both ordinary and suspicious queries. Separating them is part of the task.