A computer-implemented method for identifying threat actors using domain data, the method comprising: obtaining domain data from one or more data sources (115, 120, 125), wherein the domain data includes information associated with each of a plurality of domains, wherein the domain data for each domain identifies at least one corresponding brand owner with which the domain is associated, and wherein the domain data for each domain includes one of more of the group consisting of: web page content of the domain, domain registration data for the domain, and infrastructure data for the domain; examining the obtained domain data; generating, based on the examination of the obtained domain data, one or more domain clusters, wherein each domain cluster includes a corresponding subset of the domains in the plurality of domains, and wherein each domain cluster is determined based on computed similarities with others of the plurality of domains in the subset; determining, for each of the generated domain clusters, whether the domain cluster is associated with a threat actor; identifying (435, 550, 650), for each of the generated domain clusters that is associated with a threat actor, one or more brand owners associated with the threat actor; and providing (440, 555, 655), for each of the generated domain clusters that is associated with a threat actor, an indication of the threat actor to one or more client devices of the one or more brand owners associated with the threat actor. obtaining domain data from one or more data sources (115, 120, 125), wherein the domain data includes information associated with each of a plurality of domains, wherein the domain data for each domain identifies at least one corresponding brand owner with which the domain is associated, and wherein the domain data for each domain includes one of more of the group consisting of: web page content of the domain, domain registration data for the domain, and infrastructure data for the domain; wherein the domain data includes information associated with each of a plurality of domains, wherein the domain data for each domain identifies at least one corresponding brand owner with which the domain is associated, and wherein the domain data for each domain includes one of more of the group consisting of: web page content of the domain, domain registration data for the domain, and infrastructure data for the domain; examining the obtained domain data; generating, based on the examination of the obtained domain data, one or more domain clusters, wherein each domain cluster includes a corresponding subset of the domains in the plurality of domains, and wherein each domain cluster is determined based on computed similarities with others of the plurality of domains in the subset; wherein each domain cluster includes a corresponding subset of the domains in the plurality of domains, and wherein each domain cluster is determined based on computed similarities with others of the plurality of domains in the subset; determining, for each of the generated domain clusters, whether the domain cluster is associated with a threat actor; identifying (435, 550, 650), for each of the generated domain clusters that is associated with a threat actor, one or more brand owners associated with the threat actor; and providing (440, 555, 655), for each of the generated domain clusters that is associated with a threat actor, an indication of the threat actor to one or more client devices of the one or more brand owners associated with the threat actor.