Communication account contact ingestion and aggregation
Techniques for detecting spam accounts in a system are described. When a system creates a user profile, the system may ingest a blocked communications list. The system may determine how many times each blocked communications number represented in the ingested blocked communications list is included in blocked communications lists of various users of the system. If a blocked communications number represented in the ingested blocked communications list is included in at least a threshold number of other blocked communications lists, the system may mark the communications number as spam at a system level and engage in appropriate mitigation techniques (e.g., throttle the phone numbers activity, disable the phone number's ability to communicate with system devices, etc.).
1. A computer-implemented method, comprising:
receiving, from a device during a profile setup process, first data representing a first telephone number blocked by a user of the device;
determining the first telephone number is included in at least a threshold number of blocked call lists, each blocked call list of the blocked call lists being associated with at least one respective user profile; and
identifying the first telephone number as a first spam telephone number.
2. The computer-implemented method of claim 1 , further comprising:
determining the first telephone number was to be presented on a caller ID of the device for a telephone call;
determining a second telephone number corresponding to a source of the telephone call;
determining the first telephone number is different from the second telephone number; and
identifying the second telephone number as a second spam telephone number.
3. The computer-implemented method of claim 1 , further comprising:
during the profile setup process, receiving contact list data from the device;
determining the contact list data includes a contact identifier;
determining the contact identifier is included in a list of spam contact identifiers;
determining a second telephone number associated with the contact identifier;
determining at least a threshold number of contact lists include the contact identifier associated with the second telephone number; and
identifying the second telephone number as a second spam telephone number.
4. The computer-implemented method of claim 1 , further comprising:
determining the first data includes an internet protocol (IP) address;
determining the IP address is included in at least the threshold number of blocked call lists; and
identifying the IP address as a spam communications source.
5. A system, comprising:
at least one processor; and
at least one memory including instructions that, when executed by the at least one processor, cause the system to:
receive, from a device as part of a contact information ingestion process, first data representing a first communications identifier (ID) blocked by a user of the device;
determine the first communications ID is included in different blocked communications lists, each blocked communication list being associated with at least one respective user profile; and
identify the first communications ID as a first spam communications ID.
6. The system of claim 5 , wherein the instructions, when executed by the at least one processor, further cause the system to:
determine the first communications ID was to be presented as a source of a communication;
determine a second communications ID corresponding to the source;
determine the first communications ID is different from the second communications ID; and
identify the second communications ID as a second spam communications ID.
7. The system of claim 5 , wherein the instructions, when executed by the at least one processor, further cause the system to:
determine a first average communications duration associated with the first communications ID;
determine a second average communications duration based at least in part on communications activity data associated with a plurality of user profiles of the system; and
determine the first average communications duration is less than the second average communications duration by at least a predetermined duration,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the first average communications duration is less than the second average communications duration by at least the predetermined duration.
8. The system of claim 5 , wherein the instructions, when executed by the at least one processor, further cause the system to:
determine a first communications initiation frequency associated with the first communications ID;
determine a second communications initiation frequency based at least in part on communications activity data associated with a plurality of user profiles of the system; and
determine the first communications initiation frequency is greater than the second communications initiation frequency by at least a predetermined frequency,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the first communications initiation frequency is greater than the second communications initiation frequency by at least the predetermined frequency.
9. The system of claim 5 , wherein the instructions, when executed by the at least one processor, further cause the system to:
determine the first communications ID is associated with contact list data;
determine the contact list data includes a number of contacts; and
determine the number of contacts exceeds a threshold number of contacts,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the number of contacts exceeds the threshold number of contacts.
10. The system of claim 5 , wherein the instructions, when executed by the at least one processor, further cause the system to:
determine a first communications request response frequency associated with the first communications ID;
determine a second communications request response frequency based at least in part on communications activity data associated with a plurality of user profiles of the system; and
determine the first communications request response frequency is less than the second communications request response frequency by at least a predetermined frequency,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the first communications request response frequency is less than the second communications request response frequency by at least the predetermined frequency.
11. The system of claim 5 , wherein the first communications ID corresponds to an outgoing telephone number, an outgoing voice over internet protocol (VoIP) number, or an IP address.
12. The system of claim 5 , wherein the instructions, when executed by the at least one processor, further cause the system to:
as part of the contact information ingestion process, receive contact list data from the device;
determine the contact list data includes a contact identifier;
determine the contact identifier is included in a list of spam contact identifiers;
determine a second communications ID associated with the contact identifier;
determine at least a threshold number of contact lists include the contact identifier associated with the second communications ID; and
identify the second communications ID as a second spam communications ID.
13. A computer-implemented method, comprising:
receiving, from a device as part of a contact information ingestion process, first data representing a first communications identifier (ID) blocked by a user of the device;
determining the first communications ID is included in different blocked communications lists, each blocked communications list being associated with at least one respective user profile; and
identifying the first communications ID as a first spam communications ID.
14. The computer-implemented method of claim 13 , further comprising:
determining the first communications ID was to be presented as a source of a communication;
determining a second communications ID corresponding to the source;
determining the first communications ID is different from the second communications ID; and
identifying the second communications ID as a second spam communications ID.
15. The computer-implemented method of claim 13 , further comprising:
determining a first average communications duration associated with the first communications ID;
determining a second average communications duration based at least in part on communications activity data associated with a plurality of user profiles; and
determining the first average communications duration is less than the second average communications duration by at least a predetermined duration,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the first average communications duration is less than the second average communications duration by at least the predetermined duration.
16. The computer-implemented method of claim 13 , further comprising:
determining a first communications initiation frequency associated with the first communications ID;
determining a second communications initiation frequency based at least in part on communications activity data being associated with a plurality of user profiles; and
determining the first communications initiation frequency is greater than the second communications initiation frequency by at least a predetermined frequency,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the first communications initiation frequency is greater than the second communications initiation frequency by at least the predetermined frequency.
17. The computer-implemented method of claim 13 , further comprising:
determining the first communications ID is associated with contact list data;
determining the contact list data includes a number of contacts; and
determining the number of contacts exceeds a threshold number of contacts,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the number of contacts exceeds the threshold number of contacts.
18. The computer-implemented method of claim 13 , further comprising:
determining a first communications request response frequency associated with the first communications ID;
determining a second communications request response frequency based at least in part on communications activity data associated with a plurality of user profiles; and
determining the first communications request response frequency is less than the second communications request response frequency by at least a predetermined frequency,
wherein the first communications ID is identified as the first spam communications ID based at least in part on determining the first communications request response frequency is less than the second communications request response frequency by at least the predetermined frequency.
19. The computer-implemented method of claim 13 , wherein the first communications ID corresponds to an outgoing telephone number, an outgoing voice over internet protocol (VoIP) number, or an IP address.
20. The computer-implemented method of claim 13 , further comprising:
as part of the contact information ingestion process, receiving contact list data from the device;
determining the contact list data includes a contact identifier;
determining the contact identifier is included in a list of spam contact identifiers;
determining a second communications ID associated with the contact identifier;
determining at least a threshold number of contact lists include the contact identifier associated with the second communications ID; and
identifying the second communications ID as a second spam communications ID.