Data analytics tool

A device for Internet security, the device comprising one or more processors configured to:

• receive historical data on fraudulent accounts, including previously submitted, user-provided email addresses used to open other accounts, from a plurality of websites, wherein the plurality of websites includes at least two non-affiliated websites operated by different entities;
• determine, using a machine learning model, indicators of fraudulent accounts within the historical data on the fraudulent accounts, wherein the indicators of fraudulent accounts comprise, for each user-provided email address, an account creation rate for fraudulent users computed over a defined time window across the plurality of websites and an image hash of a fraudulent user, and the machine learning model processes the historical data on fraudulent accounts from the plurality of websites to determine the account creation rate for fraudulent users after normalizing email addresses by alias conflation and punctuation removal;
• receive a query from a website, the query including:
• data associated with a user establishing an account with the website, the data associated with the user comprises a user-provided email address related to establishing the account;
• and
• an image associated with the account;
• processing, using the one or more processors, fraudulent account data received from another website different than the website to generate the historical data in a format compatible with the machine learning model, including normalizing user-provided email addresses by removing punctuation and aliasing variations;
• compare, using the machine learning model, the data associated with the user to the indicators of fraudulent accounts to determine when the account is likely to be fraudulent, wherein the comparing includes comparing an account creation rate associated with the normalized user-provided email address to the account creation rate for fraudulent users computed across the plurality of websites within the defined time window and comparing the image associated with the account with the image hash of the fraudulent user;
• and
• when the account is likely to be fraudulent, transmitting an indication to the website, the indication indicating a suspected attempt to establish a fraudulent account.

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage devices storing computing instructions configured to run on the one or more processors and cause the one or more processors to perform:
• receiving historical data on fraudulent accounts, including previously submitted, user-provided email addresses used to open other accounts, from a plurality of websites, wherein the plurality of websites includes at least two non-affiliated websites operated by different entities;
• determining, using a machine learning model, indicators of fraudulent accounts within the historical data on the fraudulent accounts, wherein the indicators of fraud fraudulent accounts comprise, for each user-provided email address, an account creation rate for fraudulent users computed over a defined time window across the plurality of websites and an image hash of a fraudulent user, and the machine learning model processes the historical data on fraudulent accounts from the plurality of websites to determine the account creation rate for fraudulent users after normalizing email addresses by alias conflation and punctuation removal;
• receiving a query from a website, the query including:
• data associated with a user establishing an account with the website, the data associated with the user comprises a user-provided email address related to establishing the account;
• and
• an image associated with the account;
• processing fraudulent account data received from another website different than the website to generate the historical data in a format compatible with the machine learning model, including normalizing user-provided email addresses by removing punctuation and aliasing variations;
• comparing, using the machine learning model, the data associated with the user to the indicators of fraudulent accounts to determine when the account is likely to be fraudulent, wherein the comparing includes comparing an account creation rate associated with the normalized user-provided email address to the account creation rate for fraudulent users computed across the plurality of websites within the defined time window and comparing the image associated with the account with the image hash of the fraudulent user;
• and
• when the account is likely to be fraudulent, transmitting an indication to the website, the indication indicating a suspected attempt to establish a fraudulent account.