1. A computer implemented method of determining computing device characteristics from computer network activity, comprising: accessing, by one or more processors of a data processing system from a database, data identifying a global cluster, the global cluster indicating an interest category determined based on communications between a plurality of content access computing devices and a plurality of content publisher computing devices; identifying a sub-cluster of the global cluster based on a characteristic common to content access computing devices that are associated with the interest category indicated by the global cluster; identifying a first correlation between the characteristic and the interest category; identifying an interest associated with a first content access computing device not associated with the global cluster, based on a communication between the first content access computing device and a first content publisher computing device via a computer network; associating the first content access computing device with the global cluster based on the interest associated with the first content access computing device and the interest category; and determining a status of the first content access computing device based on the association of the first content access device with the global cluster and the identified first correlation between the characteristic and the interest category, the status indicating a likelihood that the first content access device is associated with the characteristic.