1. A computer-implemented method, comprising: partitioning landing pages associated with advertisements into training landing pages and testing landing pages; iteratively training a classification model on malware intrusion features of the training landing pages, the malware intrusion features being characterized by multiple redirects, in response to an input to access the advertisements, to an exploit server that is different from a server serving the advertisements; iteratively testing the classification model on the malware intrusion features of the testing landing pages until an occurrence of a testing cessation event; and storing an association of feature weights and malware intrusion features in the classification model in response to the cessation event, the association of feature weights and malware intrusion features derived from the iterative training and testing.