1. A method comprising: at a computing device, classifying a first domain name as either a likely domain generation algorithm (DGA) domain name or a likely non-DGA domain name, based on one or more features of the first domain name; determining statistics regarding requests for the first domain name; identifying any additional domain names that share an infrastructure with the first domain name; determining whether one or more of the first domain name and one or more of the additional domain names are likely to have been generated by a DGA, based on a result of one or more of the classifying, the statistics, or the identifying; and mitigating a security vulnerability related to one or more of the likely DGA domain names.