A method of dealing with information on computer objects, the method comprising: at a first threat server , receiving data about a first computer object from a remote computer on which the object is stored and or processed, wherein the data about the first computer object includes data uniquely identifying the first computer object; determining, by the first threat server , whether the first computer object has been previously seen at the first threat server by comparing the data uniquely identifying the first computer object to a plurality of data uniquely identifying plural computer objects in a first database associated with the first threat server ; if the first computer object has not been previously seen at the first threat server, receiving, by the first threat server , additional data about the first computer object from the remote computer and storing the data and the additional data about the first computer object in a second database associated with the first threat server; providing, by the first threat server , contents of the second database to at least one database associated with a central server via a storage , wherein the contents comprise a signature of the first computer object, behavior information about the first computer object, and information about the remote computer; if the first computer object has been previously seen at the first threat server, increasing, by the first threat server, a count associated with a number of times that the first computer object has been seen at the first threat server, and providing the increased count to the central server; and receiving, at a second threat server , at least a portion of the contents of the at least one database associated with the central server, wherein the at least a portion of the contents of the least one database associated with the central server includes a subset of the data associated with the first computer object stored in the second database. at a first threat server , receiving data about a first computer object from a remote computer on which the object is stored and or processed, wherein the data about the first computer object includes data uniquely identifying the first computer object; determining, by the first threat server , whether the first computer object has been previously seen at the first threat server by comparing the data uniquely identifying the first computer object to a plurality of data uniquely identifying plural computer objects in a first database associated with the first threat server ; if the first computer object has not been previously seen at the first threat server, receiving, by the first threat server , additional data about the first computer object from the remote computer and storing the data and the additional data about the first computer object in a second database associated with the first threat server; providing, by the first threat server , contents of the second database to at least one database associated with a central server via a storage , wherein the contents comprise a signature of the first computer object, behavior information about the first computer object, and information about the remote computer; if the first computer object has been previously seen at the first threat server, increasing, by the first threat server, a count associated with a number of times that the first computer object has been seen at the first threat server, and providing the increased count to the central server; and receiving, at a second threat server , at least a portion of the contents of the at least one database associated with the central server, wherein the at least a portion of the contents of the least one database associated with the central server includes a subset of the data associated with the first computer object stored in the second database. <EOS>