1. A method of detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; and determining the existence of the first network.