Patent ID: 8769673

Claim:
A computing device having computer-executable instructions embodied thereon that, when executed, perform a method for identifying potentially harmful, malicious, or unwanted content based upon entity associations, the method comprising: identifying executable content associated with a domain the identified executable content is known to be associated with harmful, malicious, or unwanted content; identifying one or more entities associated with the executable content for classification, wherein identifying the one or more entities for classification comprises: (1) identifying a first entity that hosts the identified executable content; (2) assigning a first suspicion level to the first entity; (3) identifying a second entity that is referenced in content surrounding the identified executable content that is hosted by the first entity; and (4) assigning a second suspicion level to the second entity, the second suspicion level indicating a lesser suspicion than the first suspicion level; mapping a relationship of the second entity to the first entity on a relational map; utilizing comparative suspicion levels of the first and second entities to prioritize examination, wherein the comparative suspicion levels represent a proximity to the identified executable content, wherein prioritizing examination comprises: (1) comparing the assigned suspicion level of the first entity with the assigned suspicion level of the second entity; and (2) prioritizing the first entity for examination over the second entity when the second level of suspicion is lesser than the first level of suspicion; monitoring the associated domain for a change in executable content associated therewith; identifying at least one characteristic associated with the change in the executable content based on monitoring the associated domain; and indexing the at least one identifying characteristic associated with the change in the executable content in association with the executable content.