1. A method, comprising: extracting a set of accessed domain names from a set of events by applying a late binding schema to the set of events; identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the domain name was registered with a registrar or when the domain name was first detected within the set of events; identifying an accessed domain name in the set of accessed domain names for which the identified respective registration time is recent relative to times for other accessed domain names in the set of accessed domain names; determining, for the identified domain name, an access count corresponding to how many times the set of events indicates that the identified domain name was accessed; causing display of information relating to the access count; wherein the method is performed by one or more computing devices.