Social Account Takeover Detection: Login Risk Scoring

Auto-lock threshold 70

Auto-play speed Off

Risk Score

Composite risk 0/100

Implied velocity

— km/h

Accounts locked

Events scored

Fail streak

Event Log

How it works

Every login attempt is a synthetic event with a real (lat, lon), device id, and outcome (success/fail) for one simulated account. Each event is scored with a weighted risk formula used in real account-security pipelines:

v = haversine(prevLoc, loc) / Δt_hours   [km/h]
velocityScore = clamp(0,100, (v − 120) / 8)
deviceScore   = 30 if device is new for this account else 0
failScore     = min(60, 15 × consecutiveFailedAttempts)
timeScore     = 10 if local hour ∈ [2,5) else 0

risk = clamp(0, 100, 0.5·velocityScore + 0.25·deviceScore
                     + 0.2·failScore + 0.05·timeScore)

Impossible travel — two logins that are geographically far apart in too little time imply a physically impossible speed (faster than a commercial flight, ~900 km/h). That single signal alone can push risk above threshold.
Credential stuffing — a burst of failed attempts before a success (often from many IPs testing leaked password lists) drives up failScore even when the final login's location looks unremarkable.
Auto-lock — when composite risk crosses the threshold slider, the account is flagged and the event marker turns red; this mirrors how platforms silently step up to MFA or freeze the session rather than blocking outright.

This is a simplified version of the velocity-check / impossible-travel heuristics used by real identity-protection systems (e.g. risk-based authentication in enterprise IAM and social-platform trust & safety pipelines) — never an attack tool, only the defensive scoring side.

Low risk (allowed) Elevated (step-up MFA) Blocked (locked)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.