15. The one or more non-transitory storage media of claim 11 , wherein the second criterion is based on a threshold count.
11. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause: extracting a set of accessed domain names from a set of events stored in a field-searchable data store; identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; identifying a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion; determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed; blocking future access to each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion.