A method comprising: receiving, via an input interface, a string that corresponds to a hostname; identifying, at a computing device, a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings; applying, at the computing device, a filter to determine whether to classify the string as potentially suspicious, the filter including an entropy filter and a recency filter, wherein the filter is configured to classify the string as potentially suspicious in response to the entropy filter and the recency filter each indicating that the string is potentially suspicious, wherein the entropy filter is configured to indicate that the string is potentially suspicious based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string, and wherein the recency filter is configured to indicate that the string is potentially suspicious in response to determining that the string corresponds to a hostname that was registered or encountered by the computing device within a threshold time period (222, 224); in response to the string being classified as potentially suspicious, retrieving, at the computing device, at least one domain name system, DNS, record based on the string, wherein the at least one DNS record identifies a network accessible entity associated with the hostname; executing a rule-based engine, at the computing device, to determine, based on application of one or more rules (401, 402, 403, 404, 405, 406, 407) to the network accessible entity identified by the at least one DNS record, whether to add the string to a set of suspicious hostnames; and providing the set of suspicious hostnames to a distributed denial of service, DDoS, attack mitigation application configured to selectively ignore DNS queries that are received from sources included in the set of suspicious hostnames. receiving, via an input interface, a string that corresponds to a hostname; identifying, at a computing device, a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings; applying, at the computing device, a filter to determine whether to classify the string as potentially suspicious, the filter including an entropy filter and a recency filter, wherein the filter is configured to classify the string as potentially suspicious in response to the entropy filter and the recency filter each indicating that the string is potentially suspicious, wherein the entropy filter is configured to indicate that the string is potentially suspicious based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string, and wherein the recency filter is configured to indicate that the string is potentially suspicious in response to determining that the string corresponds to a hostname that was registered or encountered by the computing device within a threshold time period (222, 224); in response to the string being classified as potentially suspicious, retrieving, at the computing device, at least one domain name system, DNS, record based on the string, wherein the at least one DNS record identifies a network accessible entity associated with the hostname; executing a rule-based engine, at the computing device, to determine, based on application of one or more rules (401, 402, 403, 404, 405, 406, 407) to the network accessible entity identified by the at least one DNS record, whether to add the string to a set of suspicious hostnames; and providing the set of suspicious hostnames to a distributed denial of service, DDoS, attack mitigation application configured to selectively ignore DNS queries that are received from sources included in the set of suspicious hostnames. retrieving, at the computing device, at least one domain name system, DNS, record based on the string, wherein the at least one DNS record identifies a network accessible entity associated with the hostname; executing a rule-based engine, at the computing device, to determine, based on application of one or more rules (401, 402, 403, 404, 405, 406, 407) to the network accessible entity identified by the at least one DNS record, whether to add the string to a set of suspicious hostnames; and providing the set of suspicious hostnames to a distributed denial of service, DDoS, attack mitigation application configured to selectively ignore DNS queries that are received from sources included in the set of suspicious hostnames.