1. A method for mining behavioral data from users of a system of identified users, the method comprising: monitoring user behavior of the identified users in the system; compiling information about behavior of a user of the system within an Internet Protocol address space; estimating a nature of an Internet Protocol address the user uses to access the system by determining whether the Internet Protocol address is static or dynamic; characterizing the Internet Protocol address according to a network type, identifying user behavior as malicious activity; and performing a plurality of proactive measures against the malicious activity, each of the plurality of proactive measures being performed for a length of time, wherein which proactive measures are performed and the length of time for which a proactive measure of the plurality of proactive measures is performed are based on the nature of the Internet Protocol Address of the user, wherein the monitoring, the compiling, the estimating, the characterizing, the identifying, and the performing are performed in a computing system.