20. A computer-implemented method for identifying an Internet domain as potentially malicious comprising: identifying, by a processor, a set of domains, the set including at least one known malicious domain; determining, by the processor, a number of name servers that query each domain in the set of domains for each day over a period of time; for a plurality of pairs of domains from the set of domains, analyzing a similarity of name servers that queried a first domain of the pair of domains and name servers that queried a second domain of the pair of domains; grouping domains in the set of domains based on the analyzing; identifying domains in a group that contains the known malicious domain as one of malicious and potentially malicious; determining a confidence level for each group of domains that the domains in the group are malicious; and automatically adding a domain to a blacklist when the confidence level is high.
20. A computer-implemented method for identifying an Internet domain as potentially malicious comprising: identifying, by a processor, a set of domains, the set including at least one known malicious domain; determining, by the processor, a number of name servers that query each domain in the set of domains for each day over a period of time; for a plurality of pairs of domains from the set of domains, analyzing a similarity of name servers that queried a first domain of the pair of domains and name servers that queried a second domain of the pair of domains; grouping domains in the set of domains based on the analyzing; identifying domains in a group that contains the known malicious domain as one of malicious and potentially malicious; determining a confidence level for each group of domains that the domains in the group are malicious; and automatically adding a domain to a blacklist when the confidence level is high. 21. The method of claim 20 , wherein each server is an aggregation of servers sharing a same IP address prefix.