1. A method implemented in a computer system for detecting false positives among a plurality of search patterns of web sites that include illegitimate content comprising: accessing a first page of a legitimate web site; obtaining all links included in the first page; for each link included in the first page that points to a page on the web site, determining whether the link matches at least one of the plurality of search patterns; and for each link that matches the search pattern, indicating that the search pattern is a false positive.