1. A method in an Internet-based proxy service server to record Internet visitor threat information, the method comprising: accessing a set of one or more visitor characteristics for a plurality of visitors to a set of one or more domains owned or operated by a first customer, the set of visitor characteristics being reported from a set of one or more proxy servers that are situated between client devices and a set of one or more origin servers for the set of domains; causing the set of visitor characteristics to be displayed through a threat reporting interface of the Internet-based proxy service server that allows the first customer to report visitors as posing an Internet security threat; receiving input from the first customer through the threat reporting interface that at least one of the visitors poses an Internet security threat; and recording the at least one of the visitors poses an Internet security threat in one or more threat databases that are used by the set of proxy servers when determining whether to allow visitors to access network resources hosted at a set of one or more origin servers.