A method for identifying malicious domains on a computer comprising: the computer executing a DNS crawl of all known domains on the internet augmented by passive DNS data; the computer extracting nameserver hostnames from DNS data; the computer retrieving email addresses from Whois data; the computer retrieving registrant names from Whois data; the computer identifying which registrant names have a large variation of registration emails through the use of parsed Whois data; the computer excluding registrant names with a large variation of registration emails from input data; the computer excluding registrants with a registrant name identical to the domain name from the input data; the computer employing blacklist data feeds to identify domains identified in the data feeds; the computer generating a proximity score for each domain, with suspect domains having a high proximity score indicating a high likelihood the suspect domain is malicious, by: executing an algorithm for each domain attribute of each domain; wherein the algorithm generates counts detailing the total number of domains on blacklists, total number of domains, number of active domains on blacklists, and total number of active domains for each domain attribute of each domain; and for each domain: interpreting the input data and the generated counts to assign attribute scores to each domain using the algorithm; and selecting the highest attribute score as the domain proximity score; and the computer flagging suspect domains as malicious. the computer executing a DNS crawl of all known domains on the internet augmented by passive DNS data; the computer extracting nameserver hostnames from DNS data; the computer retrieving email addresses from Whois data; the computer retrieving registrant names from Whois data; the computer identifying which registrant names have a large variation of registration emails through the use of parsed Whois data; the computer excluding registrant names with a large variation of registration emails from input data; the computer excluding registrants with a registrant name identical to the domain name from the input data; the computer employing blacklist data feeds to identify domains identified in the data feeds; the computer generating a proximity score for each domain, with suspect domains having a high proximity score indicating a high likelihood the suspect domain is malicious, by: executing an algorithm for each domain attribute of each domain; wherein the algorithm generates counts detailing the total number of domains on blacklists, total number of domains, number of active domains on blacklists, and total number of active domains for each domain attribute of each domain; and for each domain: interpreting the input data and the generated counts to assign attribute scores to each domain using the algorithm; and selecting the highest attribute score as the domain proximity score; and executing an algorithm for each domain attribute of each domain; wherein the algorithm generates counts detailing the total number of domains on blacklists, total number of domains, number of active domains on blacklists, and total number of active domains for each domain attribute of each domain; and for each domain: interpreting the input data and the generated counts to assign attribute scores to each domain using the algorithm; and selecting the highest attribute score as the domain proximity score; and interpreting the input data and the generated counts to assign attribute scores to each domain using the algorithm; and selecting the highest attribute score as the domain proximity score; and the computer flagging suspect domains as malicious.