1. A computer-implemented method, comprising: at a domain name system (DNS) computing system that is in network communication with one or more clients that submit DNS requests and in network communication with one or more servers associated with respective domains: performing an analysis of one or more substrings associated with a target domain name relative to a database of malicious substrings; when the analysis indicates a correspondence with one or more malicious substrings, automatically retrieving content associated with the target domain name and generating one or more vectors based on the content; comparing the one or more vectors with a corpus of vectors associated with malicious content, wherein comparing includes determining a similarity score for the target domain name relative to a first document in the corpus and the similarity score is based on a distance between the one or more vectors for the target domain name and one or more vectors in the corpus for the first document; and automatically generating a domain classification based on comparing the one or more vectors with the corpus of vectors, wherein automatically generating includes automatically generating domain name information for the target domain name indicating an association with malware if the similarity score is above a threshold.