11. A computer-implemented method for identifying an Internet domain as potentially malicious comprising: identifying unique name servers that query the Internet domain during a first day; identifying unique name servers that query the domain during a second day; determining, by a processor, a similarity of the unique name servers that queried the Internet domain during the first day and the unique name servers that queried the Internet domain during the second day; determining, by the processor, that the similarity meets a predetermined threshold; identifying the Internet domain as one of malicious and potentially malicious in response to determining that the similarity meets the predetermined threshold; determining a confidence level based on a difference between the similarity and the predetermined threshold; and automatically adding the domain to a blacklist when the confidence level is high.
13. The method of claim 11 , wherein determining the similarity comprises calculating a Jaccard index.