1. A method of monitoring a web site, the method comprising: maintaining a database comprising representations of a plurality of elements of interest; downloading a suspect image from the web site; preprocessing the suspect image with a computer to identify at least one suspect blob in the image, the suspect blob having an associated set of suspect blob characteristics and an associated set of suspect blob boundaries; based at least in part of the set of suspect blob boundaries, creating, with the computer, a suspect fingerprint for the suspect blob, the suspect fingerprint comprising a set of suspect fingerprint signals; based at least in part on the set of blob characteristics, identifying, from a database of image templates, at least one candidate fingerprint comprising a plurality of candidate fingerprint signals, the at least one candidate fingerprint being associated with an element of interest; calculating a plurality of similarity measures between the suspect fingerprint and the candidate fingerprint, each of the similarity measures being calculated based on a suspect fingerprint signal a respective candidate fingerprint signal; weighting each of the plurality of similarity measures; calculating a composite similarity score for the candidate blob, based on the weighted similarity measures; identifying a minimum individual similarity score from among the plurality of similarity measures; comparing the composite similarity score with a first threshold; comparing the minimum individual similarity score with a second threshold; based at least in part on a comparison of the composite similarity score with the first threshold and a comparison of the minimum similarity score with the second threshold, determining whether the suspect image is a likely match for the element of interest; and determining whether the web site is likely to be part of an illegitimate online activity, based at least in part on a determination of whether the suspect image is a likely match for the element of interest.