1. A computer-implemented method comprising: comparing respective registration times and IP addresses associated with a seed profile and a subject profile representing respective members in an on-line social networking system, the seed profile associated with a malicious user indicator; generating a partial connectedness score based on the results of the comparing; using at least one processor, generating a connectedness score for the subject profile with respect to the seed profile based on the result of the comparing, as a sum of the partial connectedness score and one or more other values; modifying the subject profile by storing the malicious user indication as associated with the subject profile based on the connectedness score.