1. A method comprising: receiving an appeal request related to a sponsored content item that was previously determined by an intrusion detection engine to be associated with malware; in response to receiving the appeal request, re-submitting one or more landing pages associated with the sponsored content to the intrusion detection engine; receiving, from the intrusion detection engine, an intrusion score that reflects whether the landing page is still associated with malware; comparing the intrusion score to a predefined intrusion threshold; and updating an appeals database with information that specifies whether the sponsored content item is still associated with malware, based on comparing the intrusion score to the predefined intrusion threshold.
4. The method of claim 1 , comprising: before receiving the intrusion score, and based on a previous determination by the intrusion detection engine, precluding serving of the sponsored content item associated with the landing page.