Potential DGA detected

Original query, unchanged.

let starttime = 10d;
let endtime = 1d;
let threshold = 100;
let nxDomainDnsEvents = DnsEvents
// ResultCode 3 => 'NXDOMAIN'
| where ResultCode == 3
| where QueryType in~ ("A", "AAAA")
| where ipv4_is_match("127.0.0.1", ClientIP) == False
| where Name !has "/"
| where Name has ".";
nxDomainDnsEvents
| where TimeGenerated > ago(endtime)
// sld = Second Level Domain
| extend sld = tostring(split(Name, ".")[-2])
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP
| where dcount_sld > threshold
// Filter out previously seen IPs
// Returns all the records from the left side that don't have matches from the right
| join kind=leftanti (nxDomainDnsEvents
    | where TimeGenerated between(ago(starttime)..ago(endtime))
    | extend sld = tostring(split(Name, ".")[-2])
    | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d)
    | where dcount_sld > threshold
    ) on ClientIP
    | order by dcount_sld desc