def is_player_suspicious(player):
    # determine whether the corresponding mturk player is suspicious
    suspicious_localities = [
        'Broad Run District', 'Short Pump', 'Mooresville', 'Hoboken',
         'Cheney Reservoir',# 'Sunnyside','Belmont', Uncomment or add as needed
    ]
    suspicious_ips_prefixes = [
        '208.19', '208.207.130', '216.65.144', '207.228.', '204.242.1.',
        '209.166', '79.175.95','206.82.', '175.29.',
        '63.113.25', '63.112.160', '208.207','45.85', '199.67',
        '136.175.100', '208.252.176','208.252.177','74.81.81',
        '154.9.1', '154.12','79.175.95', '23.26.228',
        '166.1','65.181','137.155', '196.51',
        '23.146.200',
        # the following are suspicious workers logging at the same time with almost the same ip addresses
        '136.248.38', '204.114.118','185.114.207'
    ]

    suspicious_networks = ['Interphase Communications, Inc.','IPXO LLC','Rackdog, LLC',
                           'Orion Telekom Tim d.o.o.Beograd','SoHo Internet Solutions',
                           'Private Customer','WIFIBER IKE','Neurotel Communications',
                           'Shock Hosting LLC', 'Microcast, Inc']
    if (
            player.network in suspicious_networks or
            player.locality in suspicious_localities or
            any(player.ip.startswith(prefix) for prefix in suspicious_ips_prefixes) or
            (player.hostingLikelihood > 2)
            # (player.risk_score > 60)
            # securityThreat not in['unknown', '']
    ):
        return True
    return False