Identifying potentially offending content using associations

A method for identifying potentially harmful, malicious or unwanted content based upon entity associations, the method comprising:

• identifying executable content associated with a domain;
• comparing a URL associated with the identified executable content with a list of URLs known to be associated with harmful, malicious, or unwanted content to determine if the URL associated with the identified executable content is known to be associated with harmful, malicious, or unwanted content;
• comparing the associated domain with a list of domains known to be associated with harmful, malicious, or unwanted content to determine if the associated domain is known to be associated with harmful, malicious, or unwanted content;
• determining a plurality of entities having an identifiable association with the URL associated with the identified executable content;
• assigning a suspicion level to each entity in the plurality of entities,
• wherein the Suspicion level is based on the proximity of each entity to the identified executable content such that the suspicion level decreases the more removed the entity is from the identified executable content;
• indexing the URL associated with the identified executable content and the associated domain in association with the determination whether the identified executable content and the associated domain is known to be associated with harmful, malicious, or unwanted content;
• mining the at least one database to create a relational map illustrating a proximity of the associated domain to at least one other domain or entity monitoring the associated domain and the at least one other domain for changes in executable content associated therewith;
• and
• upon identifying a change in executable content associated with the associated domain and the at least one other domain based on monitoring:
• (1) identifying a URL associated with the change in the executable content;
• (2) identifying at least one identifying characteristic associated with the change in the executable content;
• and
• (3) indexing the identified URL in association with the at least one identifying characteristic and a corresponding hosting site.

A computerized system for identifying potentially harmful, malicious, or unwanted content based upon associations, the system comprising:

• a computing device having one or more processors and one or more computer-readable storage media having computer-executable modules embodied thereon that, when executed, cause the computing device to:
• identify executable content associated with a domain;
• identify a plurality of entities having an identifiable association with at least one of the received executable content and the associated domain, wherein the at least one of the received executable content and the associated domain are known to be associated with harmful, malicious, or unwanted content;
• assign a suspicion level to each entity of the plurality of entities based upon proximity of each entity of the plurality of entities to a source of the known harmful, malicious, or unwanted content;
• utilize comparative suspicion levels to prioritize examination of each of the plurality of entities relative to one another wherein prioritizing examination of the plurality of entities comprises:
• (1) comparing the assigned suspicion level of the plurality of entities;
• (2) prioritizing a first entity for examination over a second entity when the level of suspicion of the second entity is lesser than the level of suspicion of the first entity;
• generate a relational map illustrating associations among a plurality of entities, at least one of the plurality of entities being known to be associated with harmful, malicious, or unwanted content;
• monitoring the associated domain for changes in executable content associated therewith;
• and
• upon identifying a change in the executable content associated with the associated domain based on monitoring:
• (1) identifying at least one identifying characteristic associated with the changed executable content;
• and
• (2) indexing the plurality of entities in association with the at least one identifying characteristic.