Patent Document ID: 8387145
Application ID: 12479860
Patent Flag: 1

Claim One:
1. A blacklisting method, comprising: obtaining a plurality of host properties of a plurality of hosts with a host tracking system, wherein obtaining the plurality of host properties comprises obtaining a host tracking graph, wherein the host tracking graph comprises data pertaining to the hosts and bindings of the hosts to a plurality of Internet protocol addresses over time; obtaining information pertaining to a plurality of suspicious events; and determining a blacklist at a computing device using the host properties and the information pertaining to the suspicious events; determining a plurality of user profiles, a plurality of proxy hosts, and a plurality of non-proxy hosts using the host tracking graph; wherein determining the blacklist comprises: determining a plurality of non-tracked activities using the host tracking graph and information pertaining to the proxy hosts and the non-proxy hosts; determining a plurality of tracked identifier groups; and determining the blacklist using the suspicious events and the tracked identifier groups.