Method and computing device for identifying suspicious users in message exchange systems

A computing device for detecting suspicious users in a plurality of messaging systems, configured to communicate with messaging systems, the computing device comprising:

• a non-transitory memory for storing machine-readable instructions;
• a computing processor, which, when executing the machine-readable instructions, is configured to:
• receive a plurality of user messages from the plurality of messaging systems;
• analyze each of the plurality of user messages to identify at least one message suspiciousness indicator from a pre-determined set of message suspiciousness indicators;
• in response to analyzing rendering a positive result, identify the given user message of the plurality of user messages as being associated with a respective message suspiciousness indicator;
• identify at least one user associated with the given user message in one or more of the plurality of messaging systems, the identifying comprising extracting a link from the given user message associated with the at least one user;
• create a user cluster including users having sent the link as part of their user messages;
• and in response to any one of the users of the user cluster being classified as a suspicious user, classifying all the users of the user cluster as suspicious users;
• assign each one of the at least one user a user suspiciousness indicator based on:
• at least one associated message suspiciousness indicator, each of the at least one message suspiciousness indicator contributing to the user suspiciousness indicator to change a reputation score of the at least one user based on the user suspiciousness indicator associated therewith,
• classify the at least one user and all the user of the user cluster, in the one or more of the plurality of messaging systems, as suspicious users in response to the reputation score of the at least one user exceeding a predetermined reputation threshold.