Identifying related user accounts based on authentication data
In some embodiments, upon detecting malicious activity associated with a user account, a content management system can identify other user accounts related to the malicious user account. The content management system can identify related user accounts by comparing authentication information collected for the malicious user account with authentication information collected for other user accounts. Authentication information can include IP address information, geographic information, device type, browser type, email addresses, and/or referral information, for example. The content management system can compare the content items associated with the malicious user account to content items associated with other user accounts to determine relatedness or maliciousness. After identifying related malicious user accounts, the content management system can block all related malicious user accounts.
1. A computer-implemented method comprising:
storing, by a content management system, one or more content items associated with a first user account on the content management system;
detecting, by the content management system, a malicious activity associated with the first user account;
scanning each of the one or more content items to identify malicious content in at least one content item of the one or more content items, responsive to detecting the malicious activity associated with the first user account;
in response to identifying malicious content in the at least one content item, identifying, by the content management system, that at least a second user account is related to the first user account based on at least authentication data associated with the first user account and the second user account, wherein the authentication data includes a referral account identifier linking the second user account to the first user account; and
blocking access to the first user account and the at least one second user account on the content management system.
2. The computer-implemented method of claim 1 , wherein storing, by the content management system, the one or more content items associated with the first user account on the content management system, comprises:
synchronizing the one or more content items hosted on a client device associated with the first user account with a storage device hosted on the content management system.
3. The computer-implemented method of claim 1 , wherein storing, by the content management system, the one or more content items associated with the first user account on the content management system, comprises:
uploading, via an application programming interface, the one or more content items to a storage device hosted on the content management system.
4. The computer-implemented method of claim 1 , wherein storing, by the content management system, the one or more content items associated with the first user account on the content management system, comprises:
providing a web interface to a client device associated with the first user account; and
receiving, via the web interface, the one or more content items for storage in a storage device hosted on the content management system.
5. The computer-implemented method of claim 1 , wherein the first user account and the second user account are accessed via a common client device.
6. The computer-implemented method of claim 1 , further comprising:
identifying, by the content management system, that a third user account and the first user account are accessed via a common client device based on at least a portion of a first internet protocol (IP) address associated with the first user account at least partially matching a second IP address associated with the third user account; and
blocking access to the third user account on the content management system.
7. The computer-implemented method of claim 1 , further comprising:
identifying, by the content management system, that a third user account is related to the first user account based on a common string pattern in a first user account email address and a third user account email address; and
blocking access to the third user account on the content management system.
8. The computer-implemented method of claim 1 , further comprising:
identifying, by the content management system, a third user account on the content management system;
generating, by the content management system, a hash value for the at least one content item containing malicious content;
generating, by the content management system, one or more second hash values for one or more second content items associated with the third user account;
identifying, by the content management system, a match between the hash value and at least one of the one or more second hash values;
based on the identifying, blocking access to the third user account on the content management system.
9. A non-transitory computer readable medium including one or more sequences of instructions which, when executed by one or more processors, cause:
storing, by a content management system, one or more content items associated with a first user account on a content management system;
detecting a malicious activity associated with the first user account;
scanning each of the one or more content items to identify malicious content in at least one content item of the one or more content items, responsive to detecting the malicious activity associated with the first user account;
in response to identifying malicious content in the at least one content item, identifying that at least a second user account is related to the first user account based on at least authentication data associated with the first user account and the second user account, wherein the authentication data includes a referral account identifier linking the second user account to the first user account; and
blocking access to the first user account and the at least one second user account on the content management system.
10. The non-transitory computer readable medium of claim 9 , wherein storing the one or more content items associated with the first user account on the content management system, comprises:
synchronizing the one or more content items hosted on a client device associated with the first user account with a storage device hosted on the content management system.
11. The non-transitory computer readable medium of claim 9 , wherein storing the one or more content items associated with the first user account on the content management system, comprises:
uploading, via an application programming interface, the one or more content items to a storage device hosted on the content management system.
12. The non-transitory computer readable medium of claim 9 , wherein storing the one or more content items associated with the first user account on the content management system, comprises:
providing a web interface to a client device associated with the first user account; and
receiving, via the web interface, the one or more content items for storage in a storage device hosted on the content management system.
13. The non-transitory computer readable medium of claim 9 , wherein the first user account and the second user account are accessed via a common client device.
14. The non-transitory computer readable medium of claim 9 , further comprising:
identifying that a third user account and the first user account are accessed via a common client device based on at least a portion of a first internet protocol (IP) address associated with the first user account at least partially matching a second IP address associated with the third user account; and
blocking access to the third user account on the content management system.
15. The non-transitory computer readable medium of claim 9 , further comprising:
identifying that a third user account is related to the first user account based on a common string pattern in a first user account email address and a third user account email address; and
blocking access to the third user account on the content management system.
16. The non-transitory computer readable medium of claim 9 , further comprising:
identifying a third user account on the content management system;
generating a hash value for the at least one content item containing malicious content;
generating one or more second hash values for one or more second content items associated with the third user account;
identifying a match between the hash value and at least one of the one or more second hash values;
based on the identifying, blocking access to the third user account on the content management system.
17. A system, comprising:
one or more processors; and
a computer readable medium including one or more sequences of instructions which, when executed by one or more processors, cause:
storing one or more content items associated with a first user account on a content management system;
detecting a malicious activity associated with the first user account;
scanning each of the one or more content items to identify malicious content in at least one content item of the one or more content items, responsive to detecting the malicious activity associated with the first user account;
in response to identifying malicious content in the at least one content item, identifying that at least a second user account is related to the first user account based on at least authentication data associated with the first user account and the second user account, wherein the authentication data includes a referral account identifier linking the second user account to the first user account; and
blocking access to the first user account and the at least one second user account on the content management system.
18. The system of claim 17 , wherein storing the one or more content items associated with the first user account on the content management system, comprises:
synchronizing the one or more content items hosted on a client device associated with the first user account with a storage device hosted on the content management system.
19. The system of claim 17 , wherein storing the one or more content items associated with the first user account on the content management system, comprises:
uploading, via an application programming interface, the one or more content items to a storage device hosted on the content management system.
20. The system of claim 17 , wherein storing the one or more content items associated with the first user account on the content management system, comprises:
providing a web interface to a client device associated with the first user account; and
receiving, via the web interface, the one or more content items for storage in a storage device hosted on the content management system.