One or more proxy logs are processed in order to generate a plurality of domain sequences. One or more domain sequences which have low support and high confidence within the plurality of domain sequences are identified. The identified domain sequences are flagged as including one or more of the following: an infected watering hole domain or an exploit kit host.