Nice read and analysis from Symantec figuring out a mechanism that dynamically generates pseudo-random domains. Complete article can be read from the link below:

Blackhole Exploit Kit Gets an Upgrade: Pseudo-random Domains | Symantec Connect Community