1. A computer network device, comprising: a reputation server module operable to derive a reputation for a plurality of network identifiers, the reputation of each network identifier determined by analyzing a plurality of high-level features related to one or more transactions originating from the network identifier.