9. A tangible, non-transitory computer-readable medium comprising computer program code that, when executed by a processor, causes the processor to: obtain over a network an Internet domain name from a user device, the Internet domain name including a plurality of characters; determine a first and second N-gram size; extract a first plurality of N-grams of the first N-gram size from the Internet domain name and extract a second plurality of N-grams of the second N-gram size from the Internet domain name; analyze the first plurality of N-grams with respect to a first model, the first model being selected from a plurality of models based on the determined first N-gram size and associated with known typical Internet domain names, wherein analyzing the first plurality of N-grams with respect to the first model includes generating a first strangeness score that is dependent on respective locations of the first plurality of N-grams within the Internet domain name; analyze the second plurality of N-grams with respect to a second model, the second model being selected from the plurality of models based on the determined second N-gram size and associated with known typical Internet domain names, wherein analyzing the second plurality of N-grams with respect to the second module includes generating a second strangeness score that is dependent on respective locations of the second plurality of N-grams within the Internet domain name; compare the first strangeness score and the second strangeness score with a threshold; determine whether the Internet domain name is typical based on the comparing, wherein the Internet domain name is typical when the first strangeness score and the second strangeness score are below the threshold; and in response to determining that the Internet domain name is not typical, determine that the Internet domain name is not safe, and perform, by the processor, a security action to protect the processor with respect to the unsafe Internet domain name.
9. A tangible, non-transitory computer-readable medium comprising computer program code that, when executed by a processor, causes the processor to: obtain over a network an Internet domain name from a user device, the Internet domain name including a plurality of characters; determine a first and second N-gram size; extract a first plurality of N-grams of the first N-gram size from the Internet domain name and extract a second plurality of N-grams of the second N-gram size from the Internet domain name; analyze the first plurality of N-grams with respect to a first model, the first model being selected from a plurality of models based on the determined first N-gram size and associated with known typical Internet domain names, wherein analyzing the first plurality of N-grams with respect to the first model includes generating a first strangeness score that is dependent on respective locations of the first plurality of N-grams within the Internet domain name; analyze the second plurality of N-grams with respect to a second model, the second model being selected from the plurality of models based on the determined second N-gram size and associated with known typical Internet domain names, wherein analyzing the second plurality of N-grams with respect to the second module includes generating a second strangeness score that is dependent on respective locations of the second plurality of N-grams within the Internet domain name; compare the first strangeness score and the second strangeness score with a threshold; determine whether the Internet domain name is typical based on the comparing, wherein the Internet domain name is typical when the first strangeness score and the second strangeness score are below the threshold; and in response to determining that the Internet domain name is not typical, determine that the Internet domain name is not safe, and perform, by the processor, a security action to protect the processor with respect to the unsafe Internet domain name. 10. The tangible, non-transitory computer-readable medium of claim 9 , wherein the first score is generated by comparing the first plurality of N-grams to the set of N-grams.