Using exceptional changes in webgraph snapshots over time for internet entity marking

A method comprising:

• measuring, at a first time, for each domain of a plurality of domains, a number of hosts contained within that domain;
• measuring, at a second time that differs from the first time, for each domain of the plurality of domains, a number of hosts contained within that domain;
• determining, for each domain of the plurality of domains, a rate of growth in a number of hosts contained within that domain between the first time and the second time;
• and
• identifying selected domains, in the plurality of domains, which are associated with rates of growth that exceed a specified threshold;
• wherein the method is performed by at least one device comprising a processor.

A non-transitory computer-readable storage medium storing instructions, which when executed by one or more processors, perform steps comprising:

• measuring, at a first time, for each host of a plurality of hosts, a number of pages hosted on that host;
• measuring, at a second time that differs from the first time, for each host of the plurality of hosts, a number of pages hosted on that host;
• determining, for each host of the plurality of hosts, a rate of growth in a number of pages hosted on that host between the first time and the second time;
• identifying selected hosts, in the plurality of hosts, which are associated with rates of growth that exceed a specified threshold.

A non-transitory computer-readable storage medium storing instructions, which when executed by one or more processors, perform steps comprising:

• measuring, at a first time, for each domain of a plurality of domains, a number of hosts contained within that domain;
• measuring, at a second time that differs from the first time, for each domain of the plurality of domains, a number of hosts contained within that domain;
• determining, for each domain of the plurality of domains, a rate of growth in a number of hosts contained within that domain between the first time and the second time;
• and
• identifying selected domains, in the plurality of domains, which are associated with rates of growth that exceed a specified threshold.