A method for classifying network traffic data includes: selecting a subset of network destinations from the network traffic data to be evaluated to determine whether to classify the subset of network destinations with a common classification label, the common classification label corresponding to a common classification class; determining a list of vector representations for the subset of the network destinations contained in the network traffic data and a vector representation for the common classification label; computing a distance between a vector representation for a network domain and the vector representation of the classification label, the vector representation for the network domain being determined from the list of vector representations; classifying the subset of the network destinations as belonging to the common classification class based on the distance being less than a predefined threshold.