suspicious user functionality