The disclosed technology relates a system is configured to identify a domain for analysis, transmit instructions for querying the domain to each network device in a set of network devices, receive domain reports associated with the domain for analysis from the set of network devices, and determine, based on the domain reports, that the domain is associated with malicious features.