1. A computer implemented method comprising: identifying a set of malicious groups associated with a social networking system, wherein a group is an entity represented in the social networking system that users can join, the malicious groups predetermined to be associated with a type of malicious activity; determining a measure of interactions of the user with the malicious group; selecting users associated with the malicious groups, wherein each user is selected based on the determined measure of interactions of the user with the malicious groups; selecting a set of potentially malicious groups associated with the selected users; receiving, by a computer, keywords associated with the type of malicious activity and searching for keyword occurrences in content received from users of the potentially malicious groups; determining, by the computer, a level of association of each potentially malicious group with the type of malicious activity based on the keyword occurrences; and storing information describing the association of each potentially malicious group with the type of malicious activity.