The Account Sharing Candidates report now leads with a coverage figure: how many of the day’s 24 hours an account’s searches span, weighted by how much work happens in each hour. The entropy number that used to lead the report is still there, in a second column.
#What was wrong with the old number
The report was introduced in Feature: Search Anomalies and Account Sharing. It scored each account by the Shannon entropy of its hour-of-day search distribution and compared that against the theoretical maximum of 3.18.
Entropy is logarithmic, and the report scaled it linearly. That compressed the results. Consider an operator running 100 searches an hour through a 12-hour day shift and 10 an hour overnight — ten times as much work by day as by night, which is what a day shift with some after-hours activity looks like. That account scored 2.79 out of 3.18, or 87% of maximum, and the report colored it orange.
#Hours covered
Exponentiating the entropy undoes the compression. The result is the number of hours that, covered evenly, would produce the same distribution.
The day-shift operator above covers 16.3 hours. An account used evenly around the clock covers 24. Here is the same set of patterns under both measures, all at identical total search volume:
| Pattern | Entropy | Old score | Hours covered | Coverage |
|---|---|---|---|---|
| Even across all 24 hours | 3.178 | 0.99 | 24.0 | 1.00 |
| 2× day volume vs. night | 3.121 | 0.98 | 22.7 | 0.95 |
| 5× day volume vs. night | 2.935 | 0.92 | 18.8 | 0.78 |
| 10× day volume vs. night | 2.790 | 0.87 | 16.3 | 0.68 |
| 8-hour shift, light overnight trickle | 2.190 | 0.68 | 8.9 | 0.37 |
With that change, the rankings remain the same but the classifications are changed:
| Coverage | Classification | Meaning |
|---|---|---|
| < 0.70 | Elevated ⚠️ | Broad, but the day/night split is still visible |
| 0.70 – 0.90 | Anomaly 🟠 | Close to round-the-clock |
| ≥ 0.90 | Critical 🔴 | Effectively uniform across all 24 hours |
#A minimum volume
Operators with fewer than 240 lifetime searches are no longer listed.
Entropy says nothing about sample size. An account with 24 total searches, one in each hour of the day, scored a perfect 3.18 — the same as an account with a hundred thousand searches spread evenly around the clock. With that little data the hourly counts are noise, and the distribution they describe is not evidence of anything.
The threshold works out to roughly 10 searches per hourly bucket. The candidate count on the report dropped as a result. This follows the same reasoning as the low-volume gate already applied to the Search Anomaly Index.
#Entropy is still published
The entropy column remains in the report and on operator pages, so figures cited in earlier posts — including the 2.710 in the Georgia misuse analysis — can still be checked against the site.
As before, high coverage identifies candidates for investigation and does not prove account sharing. A 24/7 dispatch operation legitimately covers all 24 hours. Results should be reviewed in context, and the methodology panel on the report page shows the full calculation.
Reach out to humans@haveibeenflocked.com with any questions or concerns.