4. The invention of claim 3 , wherein the specified percentage threshold is 40%.
3. The invention of claim 1 , wherein step (b) comprises: (b1) generating multi-level hierarchical groupings of Internet Protocol (IP) addresses in the association based on similarities between at least first and second levels of domain names in failed domain-name queries made by hosts corresponding to the IP addresses; (b2determining, for each hierarchical grouping, a highest percentage of failed domain-name queries for which a most recently added IP address in the hierarchical grouping has at least first and second levels of domain names in common with another IP address in the hierarchical grouping; and (b3) identifying each highest-level hierarchical grouping having its determined percentage more than a specified percentage threshold as a candidate cluster of hosts.