1. A method comprising: determining, at a computing device comprising a processor, a frequency table that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings; determining, at the computing device, an n-gram entropy threshold based on the frequencies of occurrence; receiving, via an input interface, a particular string that corresponds to a particular hostname; applying, at the computing device, an entropy filter and at least one other filter to determine whether to classify the particular string as potentially suspicious, the entropy filter configured to classify the particular string as potentially suspicious in response to a determination that an n-gram entropy of the particular string exceeds the n-gram entropy threshold, wherein the n-gram entropy of the particular string is a function of the frequency of occurrence, indicated by the frequency table, for each n-gram in the particular string, and wherein the at least one other filter includes: an international domain name (IDN) filter configured to determine whether the particular string starts with an IDN prefix; a top level domain (TLD) filter configured to determine whether the particular string is a TLD; a length filter configured to determine whether a length of the particular string satisfies a length threshold; a recency filter configured to determine whether the particular hostname was registered or encountered by the computing device within a threshold time period; or a combination thereof; responsive to the particular string being classified as potentially suspicious, retrieving, at the computing device, at least one domain name system (DNS) record associated with the particular string, wherein the at least one DNS record identifies a network accessible entity associated with the particular hostname; and executing a rule-based engine, at the computing device, to determine, based on application of one or more rules to the network accessible entity identified by the at least one DNS record, whether to add the particular string to a set of suspicious strings.