1. A method of identifying malicious queries, comprising: applying a set of seed malicious queries to search logs to extract an Internet protocol (IP) address associated with a query in the search logs that matches one of the set of seed malicious queries; creating an expanded malicious query set by applying the IP address to the search logs to identify other queries submitted from the IP address; capturing variations of queries in the expanded malicious query set that are contained in the search logs; extracting an enlarged set of malicious queries from the search logs; and outputting the enlarged set of malicious queries and the IP address.