One quick and relatively easy win is logging IP addresses of historical logins or attempts. It's quite easy then to look for patterns that are skewed in a stran

One quick and relatively easy win is logging IP addresses of historical logins or attempts. It's quite easy then to look for patterns that are skewed in a strange way. It's hard to automate but extremely valuable for human intervention. In the case of ecommerce it's a bit easier since you can flag "good" accounts potentially and use that to weigh the analysis. In the case of simple account creation it's hard since you can't really ever call an account "good" necessarily except perhaps with a long usage history. In the past we took down botnets this way - most low to mid-grade fraudsters had a limited # of IP addresses (probably multiple PCs or such in a cafe or call centre environment) so it was fairly easy to look at all accounts that had been created from that block of IP addresses (or created elsewhere but had repeated logins from these IPs) and then sanity check by looking at quality of the accounts to see whether non-fraud had happened. I suppose in the case of S.S. their data is quite robust across multiple sites.