Patent Document ID: 10027688
Application ID: 12538612
Patent Status: 1

Claim One:
1. A method of detecting at least one malicious and/or botnet-related domain name, comprising: performing processing associated with collecting at least one domain name by monitoring Domain Name System (DNS) traffic in at least one network; performing processing associated with obtaining, during a time period, information about the at least one domain name, comprising determining if the at least one domain name is in at least one domain name white list; wherein the obtained information further comprises statistics related to the at least one domain name comprising a total number of queries to the at least one domain name during the time period and a total number of distinct source IP addresses that queried the at least one domain name during the time period; responsive to determining that the at least one domain name is not in the at least one domain name white list, performing processing associated with automatically obtaining, using at least one Internet search engine, search results for the at least one domain name; performing processing associated with analyzing the search results to determine whether at least one search result associated with the at least one domain name comprises a known malware site; and performing processing associated with classifying the at least one domain name as at least one of malicious, suspicious, and legitimate based on the analyzed search results.