Aspects of the subject disclosure may include, for example, a system or method that collects or otherwise accesses information indicating connection patterns such as IP addresses being utilized by communication devices for communication services over a time period, where the communication devices use a same credential of a single account for accessing the communication services. Hubs can be identified according to groups of the communication devices that exhibit a particular sharing pattern such as having used the one or more common IP addresses. A prediction or estimation that the single account is engaging in sharing activity can be made based on an analysis of the hubs, such as based on a number of the hubs. Other embodiments are disclosed.