17. A computer-implemented apparatus capable of characterizing unregistered domain names, comprising: a processing system, comprising one or more processors; a memory containing instructions for execution by the processing system; an obtaining mechanism configured to obtain a list of a plurality of resolution requests for a plurality of unregistered domain names, wherein each resolution request includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field; a determining mechanism configured to determine a number of occurrences of resolution requests for each of the unregistered domain names; a computing mechanism configured to compute a plurality of groupings based on the number of occurrences; and an associating mechanism configured to associate a score with each of the unregistered domain names.
17. A computer-implemented apparatus capable of characterizing unregistered domain names, comprising: a processing system, comprising one or more processors; a memory containing instructions for execution by the processing system; an obtaining mechanism configured to obtain a list of a plurality of resolution requests for a plurality of unregistered domain names, wherein each resolution request includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field; a determining mechanism configured to determine a number of occurrences of resolution requests for each of the unregistered domain names; a computing mechanism configured to compute a plurality of groupings based on the number of occurrences; and an associating mechanism configured to associate a score with each of the unregistered domain names. 22. The apparatus of claim 17 further comprising: a second determining mechanism configured to determine a number of the plurality of resolution requests associated with a particular IP address; and a reducing mechanism configured to reduce the number of the plurality of resolution requests associated with the particular IP address.