Systems and methods of determining computing device characteristics from computer network activity are provided. A data processing system can obtain data identifying a global cluster that indicates an interest category and can create a sub-cluster of the global cluster based on a characteristic common to content access computing devices. A weight indicating a correlation between the characteristic common to content access computing devices and the interest category can be assigned to the sub-cluster. Responsive to a communication between a first content access computing device and a content publisher computing device, the data processing system can identify a characteristic. The data processing system can associate the first content access computing device with the sub-cluster based on the characteristic of the first content access computing device and the characteristic common to the content access computing devices, and based on the weight can determine a status of the first content access computing device.