1. A method comprising: determining, at a computing device comprising a processor, a frequency table that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings; determining an n-gram entropy threshold based on the frequencies of occurrence; receiving a second set of strings; applying one or more filters to the second set of strings to generate a subset of strings that are determined to correspond to strings of interest, wherein the one or more filters includes an entropy filter configured to determine that a string corresponds to a potentially suspicious hostname based on an n-gram entropy of the string exceeding the n-gram entropy threshold, wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the frequency table, for each n-gram in the string; retrieving at least one domain name system (DNS) record associated with a first string of the subset, wherein the first string corresponds to a hostname and wherein the at least one DNS record identifies a network accessible entity associated with the hostname; and executing a rule-based engine to determine, based on application of one or more rules to the network accessible entity identified by the at least one DNS record, whether to add the first string to a set of suspicious hostnames.