1. A method implemented in a computer system for detecting false positives among a plurality of search patterns of web sites that include illegitimate content comprising: accessing a first page of a legitimate web site; obtaining all links included in the first page; for each link included in the first page that points to a page on the web site, determining whether the link matches at least one of the plurality of search patterns; for each link that matches the search pattern, indicating that the search pattern is a false positive; and for each link that points to a page on the web site, recursively: accessing a page pointed to by the link; obtaining all links in the page; for each link included in the page that points to a page on the web site, determining whether the link matches at least one of the plurality of search patterns; and for each link that matches the search pattern, indicating that the search pattern is a false positive; wherein each search pattern is a regular expression.