1. A computer-implemented method of identifying suspicious usage of an object, the method comprising: receiving a query from a client device regarding an object, the query including an identifier of the object and a set of associated usage attributes describing a usage of the object on the client device; identifying a set of usage facts associated with the identified object, the set of usage facts describing typical usages of the object on a plurality of client devices; determining, by a computer, whether the usage of the object on the client device is suspicious based on the set of usage facts associated with the object and the set of usage attributes included in the query; and providing a report to the client device based on the determination.