A. BTF takes the MD5 value and compares it against the dynamic database
B. BTF checks if the domain name in a DNS reply matches a name in the BTF database
C. BTF can rate-limit traffic to known botnet addresses
D. BTF redirects DNS queries to a BTF server for further analysis