1. A computer-implemented method comprising: determining that a sponsored content item has been identified as likely containing malware; identifying features of a landing page of the sponsored content item that has been identified as likely containing malware, wherein the sponsored content item directs a content viewer to the landing page in response to a selection of the sponsored content item; identifying features of another landing page of another sponsored content item that has not been identified as likely containing malware; determining that the features of the landing page of the sponsored content item that has been identified as likely containing malware are similar or identical to the features of the other landing page of the other sponsored content item that has not been identified as likely containing malware; and based on determining that the features of the landing page of the sponsored content item that has been identified as likely containing malware are similar or identical to the features of the other landing page of the other sponsored content item that has not been identified as likely containing malware, suspending distribution of the other sponsored content item that has not been identified as likely containing malware.
1. A computer-implemented method comprising: determining that a sponsored content item has been identified as likely containing malware; identifying features of a landing page of the sponsored content item that has been identified as likely containing malware, wherein the sponsored content item directs a content viewer to the landing page in response to a selection of the sponsored content item; identifying features of another landing page of another sponsored content item that has not been identified as likely containing malware; determining that the features of the landing page of the sponsored content item that has been identified as likely containing malware are similar or identical to the features of the other landing page of the other sponsored content item that has not been identified as likely containing malware; and based on determining that the features of the landing page of the sponsored content item that has been identified as likely containing malware are similar or identical to the features of the other landing page of the other sponsored content item that has not been identified as likely containing malware, suspending distribution of the other sponsored content item that has not been identified as likely containing malware. 4. The method of claim 1 , wherein determining that the features of the landing page of the sponsored content item that has been identified as likely containing malware are similar or identical to the features of the other landing page of the other sponsored content item that has not been identified as likely containing malware comprises determining that the other sponsored content item shares a same or similar Universal Resource Identifier (URI) as the sponsored content item.