22. The product of claim 12 , the operations comprising, when the intrusion score reflects that the landing page is not associated with malware, allowing serving of the sponsored content item.
12. A computer program product tangibly stored on a non-transitory storage device, operable to cause data processing apparatus to perform operations comprising: receiving an appeal request related to a sponsored content item that was previously determined by an intrusion detection engine to be associated with malware; in response to receiving the appeal request, re-submitting one or more landing pages associated with the sponsored content to the intrusion detection engine; receiving, from the intrusion detection engine, an intrusion score that reflects whether the landing page is still associated with malware; comparing the intrusion score to a predefined intrusion threshold; and updating an appeals database with information that specifies whether the sponsored content item is still associated with malware, based on comparing the intrusion score to the predefined intrusion threshold.