Method of and server for detecting associated web resources

A server for determining affiliation of network resources with a malicious infrastructure on a network, the server being configured to connect to a database via the network, the server comprising:

• a data transmission interface for data exchange via the network;
• a memory storing machine-readable instructions;
• a processor, functionally coupled to the data transmission interface and the memory, wherein the processor, upon executing the machine-readable instructions, being configured to:
• scan the network to identify a plurality of network resources;
• retrieve information associated with each one of the plurality of network resources, the information associated with a given one of the plurality of network resources comprising at least one respective parameter thereof;
• identify, in the plurality of network resources, based on the information associated with each one of the plurality of network resources, network resources having respective parameters matching the at least one respective parameter of the given one of the plurality of network resources, thereby generating network resources,
• the first subset of network resources potentially being affiliated with a respective malicious infrastructure;
• determine a number of network resources in the first subset of network resources;
• calculate, based on the number of resources in the first subset of network resources, for the at least one respective parameter, a first connection weight,
• the first connection weight being indicative of a quality value associated with the at least one respective parameter being an unambiguously characterizing indicator of the network resources having been grouped into the first subset of network resources by the at least one respective parameter being affiliated with the respective malicious infrastructure;
• the first connection weight associated with the at least one respective parameter being inversely proportional to the number of network resources in the first subset of network resources, such that:
• the fewer the number of network resources in the first subset of network resources is, the greater the first connection weight is;
• in response to the first connection weight being greater than or equal to a predetermined threshold value:
• identify, based on the at least one respective parameter, the first subset of network resources as being affiliated with the respective malicious infrastructure in the network;
• store data indicative of the at least one respective parameter in a database of network resources;
• and
• use the data indicative of the at least one respective parameter for analyzing other network resources on the network for affiliation thereof with an other malicious infrastructure;
• in response to the first connection weight being less than the predetermined threshold value, not identify the first subset of network resources as being affiliated with the respective malicious infrastructure.