A system, comprising: a scoring engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to: identify landing pages associated with sponsored content; identify intrusion features of the landing pages; generate a feature score for each of the landing pages based on the identified intrusion features, wherein a higher feature score means that the landing page is more likely to include malware; determine that the feature score for a subset of the landing pages exceeds a feature threshold and classify the one or more landing pages of the subset as candidate landing pages; and a malware evaluation engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to: submit only the one or more candidate landing pages to an intrusion detection engine; receive an intrusion score for the one or more candidate landing pages from the intrusion detection engine indicating the level of malware in the landing page; and preclude the serving of the sponsored content associated with the candidate landing page if the intrusion score exceeds an intrusion threshold. a scoring engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to: identify landing pages associated with sponsored content; identify intrusion features of the landing pages; generate a feature score for each of the landing pages based on the identified intrusion features, wherein a higher feature score means that the landing page is more likely to include malware; determine that the feature score for a subset of the landing pages exceeds a feature threshold and classify the one or more landing pages of the subset as candidate landing pages; and a malware evaluation engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to: submit only the one or more candidate landing pages to an intrusion detection engine; receive an intrusion score for the one or more candidate landing pages from the intrusion detection engine indicating the level of malware in the landing page; and preclude the serving of the sponsored content associated with the candidate landing page if the intrusion score exceeds an intrusion threshold. identify landing pages associated with sponsored content; identify intrusion features of the landing pages; generate a feature score for each of the landing pages based on the identified intrusion features, wherein a higher feature score means that the landing page is more likely to include malware; determine that the feature score for a subset of the landing pages exceeds a feature threshold and classify the one or more landing pages of the subset as candidate landing pages; and a malware evaluation engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to: submit only the one or more candidate landing pages to an intrusion detection engine; receive an intrusion score for the one or more candidate landing pages from the intrusion detection engine indicating the level of malware in the landing page; and preclude the serving of the sponsored content associated with the candidate landing page if the intrusion score exceeds an intrusion threshold. submit only the one or more candidate landing pages to an intrusion detection engine; receive an intrusion score for the one or more candidate landing pages from the intrusion detection engine indicating the level of malware in the landing page; and preclude the serving of the sponsored content associated with the candidate landing page if the intrusion score exceeds an intrusion threshold.