1. A method, comprising: generating, by processing circuitry, a profile in connection with a website, wherein the profile comprises at least one attribute associated with the website; during a visit to the website, collecting, by processing circuitry, information relating to the website; detecting, by processing circuitry, a change in connection with the website, wherein detecting the change comprises identifying a variation between the generated profile and the collected information; assigning, by processing circuitry, a score based on the change; comparing, by processing circuitry, the score to a threshold; and in response to a relationship between the score and the threshold, sending, by processing circuitry, an alert identifying a suspicious or malicious website; wherein detecting the change, comprises: based on the profile, determining a-priori probability estimation; based on the collected information, determining an update probability; identifying the change between the a-priori probability estimation and the update probability; further wherein determining the a-priori probability estimation comprises determining an a-priori probability distribution P 0 using a first number w of a sequence of observations X 1 ,. .. , X n from a probability distribution where X i ∈U and u=|U|; further wherein determining the update probability comprises updating the probability distribution to P 1 (n) for every observation X n where n>w such that the probability P 1 (n) can be compared with the a-priori probability P 0 in order to detect the change.