1. A computer-implemented method of determining that a newly-registered domain is potentially malicious, the method comprising: determining, by a processor, a number of unique name servers that sent a query for the newly-registered domain during a period of time; determining, by the processor, that the number of unique servers exceeds a predetermined threshold of servers; identifying the newly-registered domain as one of malicious and potentially malicious when it is determined that the number of unique name servers exceeds the predetermined threshold of servers; in response to determining that the number of unique name servers exceeds the predetermined threshold of servers, determining a confidence level based on an amount by which the number of unique name servers exceeds the predetermined threshold of servers; and automatically adding the newly-registered domain to a blacklist when the confidence level is high.