9. The system of claim 7 , wherein each unique server is an aggregation of servers sharing a same IP address prefix.
7. A system for determining that a newly-registered domain is potentially malicious, the system comprising: a processor; and a memory having instructions, that when executed by the processor, cause the processor to perform operations including: determining, by a processor, a number of unique name servers that sent a query for the newly-registered domain during a period of time, determining, by the processor, that the number of unique name servers exceeds a predetermined threshold of servers; identifying the newly-registered domain as one of malicious and potentially malicious in response to determining that the number of unique name servers exceeds the predetermined threshold of servers; and responsive to identifying the newly-registered domain as one of malicious and potentially malicious: identifying an IP address associated with a registration record for the newly-registered domain, and determining a confidence level based on whether the IP address is associated with a tainted server.