15. One or more computer readable non-transitory storage media encoded with software comprising computer executable instructions that when executed by one or more processors, cause the one or more processors to: classify each one of first domain names as either a likely domain generation algorithm (DGA) domain name or a likely non-DGA domain name, based on evaluation of one or more features of the first domain names, producing a first pool of likely DGA domain names determine statistics regarding requests for the likely DGA domain names in the first pool to identify a second pool of likely DGA domain names out of the first pool, wherein, for each of the likely DGA domain names in the second pool, the statistics of the requests indicate a spike over a period of time, wherein a number of the likely DGA domain names in the second pool is less than a number of the likely DGA domain names in the first pool; identify additional domain names that share an infrastructure with the likely DGA domain names in the second pool; and mitigate a security vulnerability related to one or more of the likely DGA domain names in the second pool and the additional domain names.
15. One or more computer readable non-transitory storage media encoded with software comprising computer executable instructions that when executed by one or more processors, cause the one or more processors to: classify each one of first domain names as either a likely domain generation algorithm (DGA) domain name or a likely non-DGA domain name, based on evaluation of one or more features of the first domain names, producing a first pool of likely DGA domain names determine statistics regarding requests for the likely DGA domain names in the first pool to identify a second pool of likely DGA domain names out of the first pool, wherein, for each of the likely DGA domain names in the second pool, the statistics of the requests indicate a spike over a period of time, wherein a number of the likely DGA domain names in the second pool is less than a number of the likely DGA domain names in the first pool; identify additional domain names that share an infrastructure with the likely DGA domain names in the second pool; and mitigate a security vulnerability related to one or more of the likely DGA domain names in the second pool and the additional domain names. 17. The computer readable non-transitory storage media of claim 15 , wherein the executable instructions that cause the one or more processors to mitigate the security vulnerability comprise executable instructions that cause the one or more processors to perform one or more of: blocking access to domains identified by the one or more of the likely DGA domain names in the second pool and the additional domain names; monitoring access to the domains identified by the one or more of the likely DGA domain names in the second pool and the additional domain names; or asserting an alarm condition in response to access to the domains identified by the one or more of the likely DGA domain names in the second pool and the additional domain names.