Spot abuse and account attacks while they are happening.
Count sign-ins, devices, cards, sign-ups and messages per user, device, network and email domain. Ask at the moment of sign-in or checkout, or have the results pushed to your review queue.
watching
watching
watching
The questions this answers
Typical questions, each with the window it usually looks at. Thresholds are starting points you set yourself.
- Stop credential stuffing
How many different accounts did this IP address or network try, and how many of the attempts failed?
rolling 10 minutes and 1 hour - Confirm new devices
Has this user ever signed in from this device before?
since the account opened - Stop push bombing
Were several second-factor prompts denied, and then one approved minutes later?
rolling 10 minutes - Catch card cycling
How many different cards were tried on this device, and how many users share each card?
rolling 24 hours, counted exactly - Stop sign-up and coupon bursts
How many sign-ups or coupon redemptions came from one device, email domain or network?
rolling 1 hour - Throttle message blasts
How many messages did this user send, to how many different people, and how often were they reported?
rolling 10 minutes
One network trying many accounts
A bot tries leaked passwords against many accounts from addresses in one network. Each account sees only a failure or two, but every failure also counts for the network, so the burst stands out. Your sign-in asks for a second factor, and your review tool gets the network. The 20 accounts are a starting value you set.
- Send every failed sign-in with the user, the IP address and the device
- Define running totals per network, with IPv6 addresses grouped by /64: failures, and different accounts tried
- Ask at each sign-in; a trigger on every failure also pushes the result to your webhook
- Act: ask for a second factor, and open a review case when credential_stuffing holds
{
"id": "evt_8f2c1",
"type": "signin_failed",
"ts": "2026-11-02T09:14:07Z",
"attrs": {
"user_id": "u_4821",
"ip": "2001:db8:4f1a:22::17",
"device_id": "dv_93ac"
}
}{
"name": "signin_check",
"description": "Sign-in risk for a user, from this network and device",
"spec": {
"entity": "user",
"context": ["network", "device"],
"features": {
"networkFailures15m": {
"state": "failures_by_network",
"window": {"rolling": "15m"}
},
"networkAccountsTried10m": {
"state": "accounts_failed_by_network",
"window": {"rolling": "10m"}
},
"priorSignInsOnDevice": {
"state": "signins_by_user_device",
"window": "lifetime"
}
},
"reasons": [
{"name": "credential_stuffing", "when": "networkAccountsTried10m >= 20"},
{"name": "new_device", "when": "priorSignInsOnDevice == 0"}
],
"triggers": [
{"name": "to_review", "on": "signin_failed", "outputs": ["stream"]}
]
}
}{
"entity": {"type": "user", "id": "u_4821"},
"values": {
"networkFailures15m": 64,
"networkAccountsTried10m": 31,
"priorSignInsOnDevice": 0
},
"reasons": ["credential_stuffing", "new_device"],
"degraded": [],
"skipped": [],
"profileVersion": "signin_check@v4",
"configVersion": 27,
"evaluatedAt": "2026-11-02T09:14:07.412Z"
}The parts of Aggrelis behind it
Nothing built for one industry: the same building blocks, configured for this job.
- How many different
Different accounts per network, cards per device, recipients per sender: counted exactly, or estimated for very large sets.
- Variants count as one
Emails trimmed and lower-cased, IP addresses in one form, IPv6 grouped by network, so small variations do not hide a burst.
- Across relationships
Failures of each user roll up to their company, so one password tried across its staff stands out.
- Ask at sign-in, or be told
The answer comes back inside the sign-in request, or goes to your review queue as a signed webhook.
- Step up or block
Let a decision answer no check, one-time code, passkey or block: your rules first, a model for the unclear cases.
- Tune without a release
Your security team adjusts thresholds and tests them on real traffic in the workspace before they go live.
Your first live numbers, configured not coded
Tell us what you would count first, and we'll help you set it up.