Abstract: A method of verifying an account login request may include identifying one or more Internet Protocol (IP) addresses as potentially malicious and, for each identified IP address, determining a first value equal to a number of times over a period of time that the IP address was identified by the computing device as potentially malicious, determining a second value equal to a number of times over the period of time that the IP address was confirmed to be potentially malicious by one or more account users, determining a proportion value associated with the IP address by determining a ratio of the second value to the first value, labeling the IP address as safe or unsafe based on at least the proportion value associated with the IP address, and maintaining, by the computing device, a list of the IP addresses and corresponding labels.