Some malwares use DGA (Domain Generation Algorithm) to randomly generate domains in order for the zombies to be able to communicate in a resilient manner with the C&C.
As far as I know, there is no way to acquire a TLD domain but to pay.
When I read on Wikipedia that, for example, Conficker would generate 50000 domains/day, I hardly imagine that those domains have been regularly bought. I'm probably missing something.
Does anyone know how these domains are acquired ?