1. A computer implemented method for categorizing groups of users in a social networking system based on maliciousness of activity associated with the groups, the method comprising: identifying a set of malicious groups associated with a social networking system, the malicious groups predetermined to be associated with a type of malicious activity; selecting users associated with the malicious groups, wherein each user is selected based on a measure of interactions of the user with the malicious groups exceeding a threshold value; selecting a set of potentially malicious groups associated with the selected users; receiving keywords associated with the type of malicious activity and searching for keyword occurrences in information associated with each potentially malicious group; determining a level of association of each potentially malicious group with the type of malicious activity based on the keyword occurrences; and storing information describing the association of each potentially malicious group with the type of malicious activity.