13. The method of claim 1 wherein determining includes filtering the list of resolution requests based on at least the unregistered domain name field.
1. A computer-implemented method of characterizing unregistered domain names performed by one or more processors, the method comprising: obtaining a list of a plurality of resolution requests for a plurality of unregistered domain names, wherein each resolution request includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field; determining a number of occurrences of resolution requests for each of the plurality of unregistered domain names; computing a plurality of groupings based on the number of occurrences; and associating a score with each of the unregistered domain names.