diff --git a/analytics/algs/lms.go b/detection/dga/lms.go
similarity index 99%
rename from analytics/algs/lms.go
rename to detection/dga/lms.go
index d2721a1c..d827e546 100644
--- a/analytics/algs/lms.go
+++ b/detection/dga/lms.go
@@ -1,4 +1,4 @@
-package algs
+package dga
 
 import (
 	"strings"
diff --git a/analytics/algs/lms_test.go b/detection/dga/lms_test.go
similarity index 98%
rename from analytics/algs/lms_test.go
rename to detection/dga/lms_test.go
index c465f654..c4799f7e 100644
--- a/analytics/algs/lms_test.go
+++ b/detection/dga/lms_test.go
@@ -1,4 +1,4 @@
-package algs
+package dga
 
 import "testing"
 
diff --git a/nameserver/nameserver.go b/nameserver/nameserver.go
index e2caf375..e3563657 100644
--- a/nameserver/nameserver.go
+++ b/nameserver/nameserver.go
@@ -12,7 +12,7 @@ import (
 	"github.com/safing/portbase/log"
 	"github.com/safing/portbase/modules"
 
-	"github.com/safing/portmaster/analytics/algs"
+	"github.com/safing/portmaster/detection/dga"
 	"github.com/safing/portmaster/firewall"
 	"github.com/safing/portmaster/intel"
 	"github.com/safing/portmaster/network"
@@ -180,7 +180,7 @@ func handleRequest(ctx context.Context, w dns.ResponseWriter, query *dns.Msg) er
 
 	// check for possible DNS tunneling / data transmission
 	// TODO: improve this
-	lms := algs.LmsScoreOfDomain(q.FQDN)
+	lms := dga.LmsScoreOfDomain(q.FQDN)
 	// log.Tracef("nameserver: domain %s has lms score of %f", fqdn, lms)
 	if lms < 10 {
 		tracer.Warningf("nameserver: possible data tunnel by %s: %s has lms score of %f, returning nxdomain", comm.Process(), q.FQDN, lms)