Account Takeover Lab
An account takeover does not look like a break-in — it looks like a login. Work a queue of sign-in risk events and make the call a risk-based auth engine makes in real time: allow, step-up to re-challenge, or block — then the right follow-up (notify, reset, revoke sessions, or open a case). The hard part is both edges: catch the impossible travel, the credential-stuffing replay, the MFA that was stripped by a help-desk pretext, the push-bombed approval and the adversary-in-the-middle session where MFA reads as satisfied — while not locking out the real traveller on a known device or the corporate-VPN egress that only looks like a new network. Stop the takeover without crying wolf.
The real job. More noise, a tighter clock.
Sign-in risk queue
For each sign-in, make the gate call — allow / step-up / block — and the single most-urgent follow-up.
#1
dana@northwind.com
context: Routine morning sign-in from the usual home network and laptop.
#2
mike@northwind.com
context: 412 failed password attempts in two minutes from a hosting IP, then one success — classic credential-stuffing replay.
#3
priya@northwind.com
context: A sign-in from Singapore 18 minutes after a legitimate one in New York — the user is still actively working in NY.
#4
sam@northwind.com
context: The account’s MFA was removed via a help-desk call six minutes ago, then a sign-in arrives from a new device and hosting network abroad.
#5
lee@northwind.com
context: Correct password from the usual home network, but on a brand-new, never-seen device. MFA has not been completed this session.
#6
jordan@northwind.com
context: Yesterday London, today New York — on the user’s own known device, over a clean mobile carrier, with MFA satisfied.
#7
chris@northwind.com
context: Correct password on the first try from an IP on the threat-intel known-bad list; the account never enrolled MFA.
#8
ravi@northwind.com
context: Appears to come from a datacenter 590 miles away on a "new" ASN — but it is the company’s own cloud VPN concentrator the user just connected to.
#9
taylor@northwind.com
context: One of 60+ accounts across the tenant hit with the same common password this hour; this account matched. Source is a Tor exit.
#10
noah@northwind.com
context: New laptop on an unfamiliar public Wi-Fi in the user’s home city; clean IP, no velocity, MFA not yet completed.
#11
erin@northwind.com
context: Known device and home network, but MFA fell back from the hardware key to SMS OTP — on a phone number that was changed two days ago.
#12
admin-kai@northwind.com
context: A privileged admin signs in from home on a brand-new workstation; clean network, MFA satisfied.
#13
morgan@northwind.com
context: 740 password attempts in three minutes from a hosting IP — and every single one FAILED. No success.
Stop takeovers · don't lock out real users
Call each sign-in, then grade. So far 0/13 fully called, 0/13 gate calls set, 3 benign · 6 threat.
How it is scored
Each sign-in: 2 points for the gate call, 1 for the follow-up.
Blocking a legitimate user (a traveller, a corporate-VPN egress) and allowing a real takeover each take an extra hygiene penalty.
Impossible travel is derived from distance ÷ time (over 600 mph is physically impossible). Harder tiers add subtler signals and traps (AiTM with MFA “satisfied”, push-bombing, VPN-POP pseudo-travel).
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based account-takeover (ATO) triage lab: work a queue of ~20 sign-in risk events and make the real-time gate call — allow, step-up (re-challenge), or block — plus the single most-urgent follow-up.
- Signals across the queue: impossible travel, new device, new or corporate-VPN network, IP reputation (datacenter / Tor / known-malicious), credential-stuffing velocity, password spray, and MFA state (satisfied, not-prompted, downgraded, disabled, or approved-after-push-bombing).
- You are scored on getting the gate call right while NOT locking out legitimate users — blocking a real traveller or a corporate-VPN egress carries a hygiene penalty, and so does allowing a real takeover through.
- Follow-ups are matched to the actual compromise: notify the user, force a password reset, revoke live sessions & tokens, or open an IR case — a blocked stuffing run with zero successful guesses needs no reset, while a stolen session token must be revoked.
- All travel is judged deterministically (distance ÷ time vs. a 600 mph line) against fixed snapshot values, and after grading every event explains why the right call is right.
Frequently asked questions
What is the Account Takeover Lab?
A free, in-browser exercise in risk-based authentication. For each sign-in event you read the signals — geo and travel time, device and network, IP reputation, login velocity, attack pattern, and MFA state — and decide the gate response (allow, step-up re-challenge, or block) and the correct follow-up (notify the user, force a password reset, revoke sessions and tokens, or open an incident case). You are scored on catching real takeovers without blocking legitimate users.
How is it graded?
Each event has one correct gate decision (worth 2 points) and one correct follow-up (worth 1). Two mistakes carry an extra hygiene penalty beyond the lost points: blocking a legitimate user — a real traveller on a known device, or a corporate-VPN egress that mimics new-ASN or impossible travel — and allowing a genuine takeover through. A perfect run stops every attack while locking out no one and matches each follow-up to the actual compromise.
Does it connect to a real identity provider?
No. Nothing is uploaded and no account is touched. The sign-in events are authored, realistic risk-signal snapshots bundled with the page, and every judgement — including impossible travel — is derived deterministically from fixed values (distance, time since last login, failed-attempt counts) so the queue never drifts against the clock. It runs entirely in your browser: no account, no install, nothing sent anywhere.
Who is it for?
IAM and identity engineers tuning risk-based / conditional-access policies, SOC analysts triaging sign-in risk and ATO alerts, and anyone prepping for a security interview who wants to feel why impossible travel, credential stuffing, password spray, MFA removal, push-bombing and adversary-in-the-middle are blocks — and why a traveller with a hardware key, a corporate-VPN egress, or a new device that completed MFA is not.