1. A computer-implemented method of determining that a newly-registered domain is potentially malicious, the method comprising: determining, by a processor, the number of unique servers that sent a query for the newly-registered domain during a period of time; determining, by the processor, whether the number of unique servers exceeds a predetermined threshold of servers; and flagging the newly-registered domain as potentially malicious when it is determined that the number of unique servers exceeds the predetermined threshold of servers.