Abstract: Systems, methods and computer program products for identifying and remediating in real-time (or near real-time) fraudulent activities associated with identity management systems are disclosed. An event (e.g., client request to logon to an account) is received during a time interval. An abnormal pattern in one or more characteristics of the event is determined. The event is associated with a client identity. One or more reputation scores for the client identity are determined based on event history data associated with the client identity. One or more state objects for one or more client identifier attributes are updated with the reputation scores. One or more remedial actions are implemented against the client request using the one or more updated state objects.