Reputation Clusters for Uniform Resource Locators

1 . One or more tangible, non-transitory computer-readable storage media, comprising instructions to:

enumerate domain names newly registered in a time window;

build a dictionary from the newly registered domain names;

cluster the domain names, comprising performing a spell check with the dictionary to identify similar domain names;

for a selected cluster, identify one or more domain names with an assigned reputation; and

if a portion of assigned reputations exceeds a threshold of bad reputations, assign cluster-based bad reputations to domains in the cluster with unknown reputations.

2 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the cluster-based bad reputations are temporary reputations, and wherein the instructions are further to assign an expiry to the cluster-based bad reputations.

3 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein building the dictionary comprises removing top-level domains from the domain names.

4 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the instructions are further to provide defensive registration detection.

5 . The one or more tangible, non-transitory computer-readable storage media of claim 4 , wherein the defensive registration detection comprises determining that at least some domains in the selected cluster share domain metadata with a domain registered before the time window.

6 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the spell check is a symmetric spell check.

7 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the instructions are further to deduplicate the selected cluster.

8 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the threshold of bad reputations is a simple majority.

9 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the time window is between approximately 24 and 48 hours.

10 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the time window is less than seven days.

11 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the instructions are further to determine that an insufficient number of domains in the selected cluster have a reputation, and prioritize analysis of domains in the cluster.

12 . The one or more tangible, non-transitory computer-readable storage media of claim 1 , wherein the instructions are further to determine that a supermajority of domains with reputations in the selected cluster have bad reputations, and mark domains in the selected cluster with good reputations for additional analysis.

13 . The one or more tangible, non-transitory computer-readable storage media of claim 12 , wherein the supermajority is at least ⅔.

14 . A domain name security cloud service, comprising:

a cloud hardware platform;

a scanning engine to build a list of domains registered within a time window;

a clustering module to cluster newly registered domains according to textual similarity;

a reputation engine to:

select a cluster;

identify domains within the cluster with existing reputations; and

if a majority of the domains with existing reputations are untrusted, assign an untrusted reputation to domains within the cluster that lack existing reputations; and

an endpoint application programming interface (API) to serve domain reputations to endpoints.

15 . The domain name security cloud service of claim 14 , wherein the majority is a supermajority of at least ⅔.

16 . The domain name security cloud service of claim 14 , wherein the majority is a supermajority of at least 97%.

17 . The domain name security cloud service of claim 14 , wherein the reputation engine is further to provide substring containment on domain names in the selected cluster.

18 . The domain name security cloud service of claim 14 , wherein enumerating domain names newly registered comprises scanning a plurality of registrars.

19 . A computer-implemented method of providing domain name security, comprising:

scanning a plurality of domain registrars to create a list of domain names registered within a bounded time;

clustering the domain names according to textual similarity;

for a cluster, determining that a majority of domain names with known reputations have a negative reputation; and

assigning to domain names in the cluster without known reputations the negative reputation of the majority.

20 . The method of claim 19 , wherein the negative reputation assigned to domain names in the cluster are temporary reputations, and further comprising assigning an expiry to the negative reputation.