1 A method of characterizing unregistered domain names, the method comprising: obtaining a list of a plurality of resolution requests for the unregistered domain names; determining a number of occurrences of each of the unregistered domain names; computing a plurality of groupings based on the number of occurrences; and associating a score with each of the unregistered domain names.