A practical approach for clustering large data flows of malicious URLs
Building a Dynamic Reputation System for DNS