11. A data processing system, comprising: means for training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; means for training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; means for testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; means for adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold.
11. A data processing system, comprising: means for training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; means for training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; means for testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; means for adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold. 12. The invention of claim 11 , wherein the whitelist comprises network resource identifiers that are not associated with spam or threats, and wherein the blocklist comprises network resource identifiers that are associated with spam or threats.