1. A method for detecting malicious software activity, using at least one processor, based on an Internet resource information database in memory, comprising: processing Internet activity to determine source and time information associated with at least one downloaded application, wherein the source and time information is associated with a source URL and a time at which a user downloaded the at least one downloaded application; comparing the Internet resource information database with the source and time information associated with the at least one downloaded application to identify at least one suspicious application, wherein comparing comprises communicating a request to perform a query on the Internet resource information database for attributes that match criteria within the query, wherein the Internet resource information database comprises a reputation history associated with an internet resource and a threat level that indicates prior appropriate and/or inappropriate times to access the internet resource; and monitoring execution of the at least one suspicious application.