A computer-implemented method executed by one or more processors, the method comprising: generating a bipartite graph based on network log data, wherein a plurality of nodes of the bipartite graph represent host computers and domains, and edges of the graph represent connections between a host computer and a domain accessed by that host computer; setting an initial reputation score for each of a plurality of nodes representing host computers and each of a plurality of nodes representing domains accessed by the plurality of host computers; until a predefined condition is satisfied, iteratively: rescoring the reputation scores for each of the plurality of nodes representing host computers based upon the reputation scores of the plurality of nodes representing domains, and rescoring the reputation scores for each of the plurality of nodes representing domains based upon the reputation scores of the plurality of nodes representing host computers; wherein a plurality of iterations are performed and at each iteration a new reputation score is calculated for each node representing a host computer and a new reputation score is calculated for each node representing a domain; and wherein rescoring the reputation scores for each of the plurality of nodes of the bipartite graph comprises: propagating the reputation score for a current node to the nodes determined as having a connection to the current node, based at least in part on the bipartite graph; receiving reputation scores from each of the nodes connected thereto; calculating a summation of the received reputation scores; and continuing to the next iteration; and if the predefined condition is satisfied, determining, based upon the rescored reputation scores for each of the plurality of nodes representing host computers and the rescored reputation scores for each of the plurality of nodes representing domains, whether one or more domains amongst the plurality of domains are exhibiting malicious behavior. generating a bipartite graph based on network log data, wherein a plurality of nodes of the bipartite graph represent host computers and domains, and edges of the graph represent connections between a host computer and a domain accessed by that host computer; setting an initial reputation score for each of a plurality of nodes representing host computers and each of a plurality of nodes representing domains accessed by the plurality of host computers; until a predefined condition is satisfied, iteratively: rescoring the reputation scores for each of the plurality of nodes representing host computers based upon the reputation scores of the plurality of nodes representing domains, and rescoring the reputation scores for each of the plurality of nodes representing domains based upon the reputation scores of the plurality of nodes representing host computers; wherein a plurality of iterations are performed and at each iteration a new reputation score is calculated for each node representing a host computer and a new reputation score is calculated for each node representing a domain; and wherein rescoring the reputation scores for each of the plurality of nodes of the bipartite graph comprises: propagating the reputation score for a current node to the nodes determined as having a connection to the current node, based at least in part on the bipartite graph; receiving reputation scores from each of the nodes connected thereto; calculating a summation of the received reputation scores; and continuing to the next iteration; and if the predefined condition is satisfied, rescoring the reputation scores for each of the plurality of nodes representing host computers based upon the reputation scores of the plurality of nodes representing domains, and rescoring the reputation scores for each of the plurality of nodes representing domains based upon the reputation scores of the plurality of nodes representing host computers; wherein a plurality of iterations are performed and at each iteration a new reputation score is calculated for each node representing a host computer and a new reputation score is calculated for each node representing a domain; and wherein rescoring the reputation scores for each of the plurality of nodes of the bipartite graph comprises: propagating the reputation score for a current node to the nodes determined as having a connection to the current node, based at least in part on the bipartite graph; receiving reputation scores from each of the nodes connected thereto; calculating a summation of the received reputation scores; and continuing to the next iteration; and if the predefined condition is satisfied, propagating the reputation score for a current node to the nodes determined as having a connection to the current node, based at least in part on the bipartite graph; receiving reputation scores from each of the nodes connected thereto; calculating a summation of the received reputation scores; and continuing to the next iteration; and if the predefined condition is satisfied, determining, based upon the rescored reputation scores for each of the plurality of nodes representing host computers and the rescored reputation scores for each of the plurality of nodes representing domains, whether one or more domains amongst the plurality of domains are exhibiting malicious behavior.