1. A data processing system, comprising: one or more processors; logic encoded in one or more media for execution and when executed operable to cause the one or more processors to perform: training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold.