Demo data

Threat Intelligence

Patterns fused from correlated transactions, ranked by severity and model confidence.

Coordinated Account Takeover

THR-001 · first seen 19 Aug 17:52 UTC

critical

Credential-stuffing entry followed by device enrolment, low-value probing and rapid escalation to a crypto off-ramp payout on ACC-40219.

Confidence

96%

Accounts affected

4 failed auth attempts in 90sHeadless browser fingerprintGeo shift US → RO in 42 min$18.4k crypto off-ramp

Recommended: Freeze outbound payouts on the account and force step-up re-authentication.

THR-002 · first seen 19 Aug 13:20 UTC

high

Micro-authorisations between $0.80 and $2.60 hitting a single PSP endpoint across 42 unrelated cards within 18 minutes.

Confidence

88%

Accounts affected

Micro-amountsSingle merchant descriptorShared ASN 200651

Recommended: Rate-limit the PSP merchant descriptor and enable 3DS challenge on sub-$5 auths.

THR-003 · first seen 19 Aug 15:10 UTC

high

Nine accounts show sessions in two continents inside a window that is not physically traversable, all via residential proxy exit nodes.

Confidence

91%

Accounts affected

1,180 km/h implied velocityResidential proxy ASNSession token reuse

Recommended: Invalidate active sessions and require device re-enrolment.

THR-004 · first seen 19 Aug 16:10 UTC

medium

Bursts of 6–9 transactions per account per hour against baseline 1.2/hour, concentrated on gambling and luxury merchants.

Confidence

79%

Accounts affected

6–9 tx/hourGambling + luxury MCCOff-hours execution

Recommended: Apply adaptive velocity ceilings for the affected merchant categories.

THR-005 · first seen 19 Aug 08:40 UTC

medium

Unrecognised device fingerprints enrolled without step-up verification, followed by profile and payee changes.

Confidence

73%

Accounts affected

Fresh fingerprintsPayee mutationNo step-up

Recommended: Require step-up verification for any payee change within 24h of device enrolment.