Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for detecting compromised resources. In one aspect, a method includes receiving a resource; determining the resource is tainted based on one or more indications that the resource has been compromised; merging the tainted resource with previous versions of the resource that were tainted to generate a most recent tainted resource; determining the tainted resource is compromised by analyzing attributes of the most recent tainted resource that satisfy one or more threshold criteria that indicate the resource has been compromised; and identifying the tainted resource as compromised.