12. One or more computing devices having stored thereupon a plurality of computer-executable instructions that, when executed by a processor, causes the processor to perform operations comprising: analyzing a plurality of labeled accounts from one or more sources, each of the plurality of labeled accounts indicating that a respective labeled account is malicious or benign; determining one or more features extracted from the plurality of accounts that distinguish a respective labeled account that is malicious and a respective labeled account that is benign, wherein at least one of the one or more features is based on memorability of email addresses, the memorability relating to a pattern of symmetry, anti-symmetry, or uniformly distanced characters in the email address; applying one or more machine learning methods to build a classification model based on the obtained one or more features; and using the classification model to determine a trust level of an incoming account.
12. One or more computing devices having stored thereupon a plurality of computer-executable instructions that, when executed by a processor, causes the processor to perform operations comprising: analyzing a plurality of labeled accounts from one or more sources, each of the plurality of labeled accounts indicating that a respective labeled account is malicious or benign; determining one or more features extracted from the plurality of accounts that distinguish a respective labeled account that is malicious and a respective labeled account that is benign, wherein at least one of the one or more features is based on memorability of email addresses, the memorability relating to a pattern of symmetry, anti-symmetry, or uniformly distanced characters in the email address; applying one or more machine learning methods to build a classification model based on the obtained one or more features; and using the classification model to determine a trust level of an incoming account. 14. The one or more computing devices as recited in claim 12 , wherein the one or more operations further comprise: comparing the trust level of the incoming account determined by the classification model with a ground truth of the trust level of the incoming account; and improving the classification model based on a result of the comparison.