In an embodiment, a data processing method providing an improvement in computer security, comprises selecting, from a domain name queue comprising a plurality of domain names, a particular domain name to analyze; extracting one or more features of the particular domain name; determining a particular risk priority score of the particular domain name based on analyzing the one or more features of the particular domain name by applying a classifier to the one or more features of the particular domain name; inserting the particular risk priority score and an identifier associated with the particular domain name into a priority queue comprising a plurality of risk priority scores and a plurality of domain names; repeating the selecting, extracting, determining, and inserting steps for the remaining domain names in the domain name queue; retrieving from the priority queue, based upon the risk priority score, the identifier associated with the particular domain name; determining the particular domain name associated with the identifier; scanning the particular domain name for malicious content or security vulnerabilities; and outputting results of the scanning to a system, database, or report.