25. A non-transitory computer-readable tangible storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of: training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold.
25. A non-transitory computer-readable tangible storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of: training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold. 32. The invention of claim 25 , wherein the logic for adding comprises logic for adding the third network resource identifier to a blocklist other than said blocklist.