Malicious Domain Scoping Recommendation System

A system comprising one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

• setting an initial reputation score for each of a plurality of host computers and each of a plurality of domains accessed by the plurality of host computers;
• until a predefined condition is satisfied, iteratively:
• rescoring the reputation scores for each of the plurality of host computers based upon the reputation scores of the plurality of domains, and
• rescoring the reputation scores for each of the plurality of domains based upon the reputation scores of the plurality of host computers;
• and
• determining, based upon the rescored reputation scores for each of the plurality of host computers and the rescored reputation scores for each of the plurality of domains, whether one or more domains amongst the plurality of domains are exhibiting malicious behavior.

A computer-readable storage device storing instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

• setting an initial reputation score for each of a plurality of host computers and each of a plurality of domains accessed by the plurality of host computers;
• until a predefined condition is satisfied, iteratively:
• rescoring the reputation scores for each of the plurality of host computers based upon the reputation scores of the plurality of domains, and
• rescoring the reputation scores for each of the plurality of domains based upon the reputation scores of the plurality of host computers;
• and
• determining, based upon the rescored reputation scores for each of the plurality of host computers and the rescored reputation scores for each of the plurality of domains, whether one or more domains amongst the plurality of domains are exhibiting malicious behavior.