1. A method for identifying attacks in a computer system, comprising: generating, via at least one computer processor, origin information for a portion of a web page; identifying a modification in the origin information; determining one or more indicators of suspicious behavior based on the identified modification in the origin information; and identifying an attack based on the determined modification, wherein generating the origin information further comprises identifying at least one of a domain or an address associated with the portion of the document, and wherein identifying at least one of a domain or an address further comprises identifying the at least one of a domain or an address within at least one of Domain Name Service (DNS) communications or DNS cached information.