18. The computer readable storage medium of claim 12 , wherein the method further comprises: receiving a network request; determining the target domain name based on processing the network request by a web server or a nameserver; and processing additional network traffic by the web server or the nameserver using the domain classification for the target domain name.
12. A computer readable storage medium having computer readable instructions for programming a processor to perform a method, the processor being part of a domain name system (DNS) computing system that is in network communication with one or more clients that submit DNS requests and in network communication with one or more servers associated with respective domains, the method comprising: automatically retrieving content associated with a target domain name when domain information associated with the target domain name indicates an association with malware; generating one or more vectors based on the content associated with the target domain name; comparing the one or more vectors with a corpus of vectors associated with malicious content, wherein comparing includes determining a similarity score for the target domain name relative to a first document in the corpus and the similarity score is based on a distance between the one or more vectors for the target domain name and one or more vectors in the corpus for the first document; and automatically generating a domain classification based on comparing the one or more vectors with the corpus of vectors, wherein automatically generating includes automatically generating domain name information for the target domain name indicating an association with malware if the similarity score is above a threshold.