20. The apparatus of claim 16 , wherein the second criterion is based on a threshold count.
16. An apparatus, comprising: an event extraction device, implemented at least partially by hardware, that extracts a set of accessed domain names from a set of events stored in a field-searchable data store; a domain name evaluation device, implemented at least partially by hardware, that identifies a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; wherein the domain name evaluation device identifies a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion; a domain name access counter device, implemented at least partially by hardware, that determines, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed; a domain name blocking device, implemented at least partially by hardware, that blocks future access to each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion.