1. A method, comprising: extracting a set of accessed domain names from a set of events stored in a field-searchable data store; identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; identifying a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion; determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed; blocking future access to each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion; wherein the method is performed by one or more computing devices.