30. A computer-readable memory as recited in claim 13 , wherein the data source comprises a domain registration zone file.
13. A non-transitory computer-readable memory having stored thereon a sequence of instructions which, when executed by a processor, cause the processor to: access a data source to obtain data about a suspicious activity; obtain, by downloading, using a master computer, the data from the data source, the data about the suspicious activity; ascertain, by parsing the obtained data, a uniform resource locator that relates to the suspicious activity, wherein the uniform resource locator is associated with an anchor, the anchor comprising a displayed address; ascertain the displayed address indicated by the anchor associated with the uniform resource locator; ascertain an actual address associated with a server referenced by the uniform resource locator; compare the displayed address with the actual address associated with the server referenced by the uniform resource locator, wherein the displayed address comprises at least one of a first domain and a first interne protocol (IP) address, and wherein the actual address associated with the server referenced by the uniform resource locator comprises at least one of a second domain and a second IP address, and further wherein the instructions cause the processor to determine whether the displayed address is different than the actual address associated with the server referenced by the uniform resource locator by performing at least one of a comparison between the first domain and the second domain, and between the first IP address and the second IP address; obtain, using the master computer, domain information about the displayed address; obtain, using the master computer, WHOIS ownership information about the displayed address; compare the obtained domain information about the a displayed address with the WHOIS ownership information about the displayed address; and determine, based on the comparison of the obtained domain information about the address configured to be displayed with the WHOIS ownership information about the displayed address and the comparison of the displayed address with the actual address associated with the server referenced by the uniform resource locator, whether the uniform resource locator is fraudulent.