1. A method comprising: receiving a service log from a service provider at a computing device, wherein the service log comprises a plurality of service requests and each service request is associated with an IP address and an account; determining IP addresses of the IP addresses associated with the plurality of service requests that are populated IP addresses by the computing device; determining a first subset of the determined populated IP addresses that are trusted based on the accounts of the service requests associated with the populated IP addresses in the service log by the computing device; determining a second subset of the determined populated IP addresses that are not trusted based on the accounts of the service requests associated with the populated IP addresses in the service log by the computing device; determining one or more features for each of the populated IP addresses in the first subset and the second subset by the computing device; and training a classifier using the determined one or more features of the populated IP addresses in the first and second subset.