ehnsignal
⌂ Home/

Abuse & fraud signals

OTP requests
612/min+840%
baseline 64/min
Failed verifications
71.4%+63pp
otp.verify.failed / otp.request
Origins over threshold
63 blocking
> 50 requests in 15 min
Accounts touched
388+212
distinct enduser.id from watched IPs
Blocked in period
1,406auto rule
rate-limit + device challenge
OTP requests vs failed verifications
span events otp.request / otp.verify.failed · Past 1 hourotp.requestotp.verify.failed
0175350525700burst detected-60m-45m-30m-15mnow
Origins under watch
grouped by client.address · rolling 15 min
client.address ASN / geo OTP req Failed Accounts Velocity Verdict
102.68.14.203AS37963 · Nairobi, KE1,2841,192214
Blocking
41.90.7.55AS33771 · Nairobi, KE48640288
Throttled
2a03:2880:f12f::AS32934 · Dublin, IE31217441
Review
197.232.61.18AS36866 · Mombasa, KE2089627
Review
154.72.19.240AS327687 · Kampala, UG1443812
Watch
88.214.26.91AS9009 · Frankfurt, DE96146
Watch
Selected origin
102.68.14.203
AS37963 · Nairobi, KE · 1,284 OTP requests · 93% failed · first seen 18m ago
client.address102.68.14.203
network.peer.asnAS37963
user_agent.originalokhttp/4.12.0 (7 variants)
enduser.id (distinct)214
event.nameotp.request, otp.verify.failed
http.route/auth/otp/request, /auth/otp/verify
otp.channelsms (98%), email (2%)
session.id (distinct)924
trace_id (sample)b7f21c04…
Abuse rules
evaluated on the OTLP stream
OTP request burst from one origincount(otp.request) by client.address > 50 / 15mFiring
Failed verification ratiootp.verify.failed / otp.request > 0.4 for 5mFiring
One origin, many accountsdistinct(enduser.id) by client.address > 20 / 1hFiring
Repeated user_agent + device fingerprintdistinct(session.id) / distinct(device.id) > 15Armed
Impossible travel on same enduser.idgeo delta > 800km within 10mArmed