5. A method according to claim 2 , wherein applying the set of heuristics to the results includes: counting the number of IP addresses to which the domain name identifier resolved; and performing a comparison operation on the number of IP addresses and a threshold number.
2. A method according to claim 1 , wherein performing the query of the domain name includes: performing a lookup operation on the domain name identifier in the local database, the local database including a set of entries, each entry of the set of entries corresponding to an attempt to access data from a data source at a network location identified by including a domain name identifier, each entry including a domain name identifier, a timestamp and an IP address to which the domain name identifier resolved.