1. A method comprising: at a computing device, classifying each one of first domain names as either a likely domain generation algorithm (DGA) domain name or a likely non-DGA domain name, based on one or more features of the first domain names, the classifying producing a first pool of likely DGA domain names; determining statistics regarding requests for the likely DGA domain names in the first pool to identify a second pool of likely DGA domain names out of the first pool, wherein, for each of the likely DGA domain names in the second pool, the statistics of the requests indicate a spike over a period of time, wherein a number of the likely DGA domain names in the second pool is less than a number of the likely DGA domain names in the first pool; identifying additional domain names that share an infrastructure with the likely DGA domain names in the second pool; and mitigating a security vulnerability related to one or more of the likely DGA domain names in the second pool and the additional domain names.