Abstract: Cloud based security is the common core of any cloud based service offering and includes in-line inspection of transaction for its customers, meaning that transactions are analyzed in real-time and a decision is made on the spot whether to allow or block the transaction based on a variety of criteria. In depth content analysis for illicit activities does not scale well to in-line transaction review. The present application discloses systems, methods and computer programs to conduct content analysis based upon a fixed time periods worth of in-line transactions, where the results of the content analysis can identify malicious sites and incorporate the identified sites into subsequent in-transaction review.