1. A computer-implemented method, comprising: performing an analysis of one or more substrings associated with a target domain name relative to a database of malicious substrings; if the analysis indicates a correspondence with one or more malicious substrings, automatically retrieving content associated with the target domain name and generating one or more vectors based on the content; comparing the one or more vectors with a corpus of vectors associated with malicious content; and automatically generating a domain classification based on comparing the one or more vectors with the corpus of vectors.