Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

MFA Fatigue Detector | Push Bombing Analysis

Authentication log analyser that detects MFA fatigue attacks from the signature pattern of repeated rejected push prompts ending in an approval, weighted by device enrolment status, source ASN classification, and geographic baseline deviation.

Live demo readyMFA + Identity Security
MFAIdentity SecurityPush BombingDetectionAuthenticationIncident ResponseCase study / interactive demo

Case study

From problem to working system

Problem

Authentication log analyser that detects MFA fatigue attacks from the signature pattern of repeated rejected push prompts ending in an approval, weighted by device enrolment status, source ASN classification, and geographic baseline deviation.

My role

Security engineer and full-stack developer

Solution

Authentication log analyser that detects MFA fatigue attacks from the signature pattern of repeated rejected push prompts ending in an approval, weighted by device enrolment status, source ASN classification, and geographic baseline deviation.

Architecture

The implementation combines the following technologies and system concerns.

MFAIdentity SecurityPush BombingDetectionAuthenticationIncident Response

How it was built

  • Detected the coercion signature specifically: a burst of denials inside a short window terminating in an approval, rather than alerting on denial count alone.
  • Weighted device enrolment and source ASN classification heavily, since an unenrolled device on hosting infrastructure is what separates an attack from a user fumbling their own login.
  • Handled the legitimate-travel case, where a new country plus an enrolled device plus a single clean approval must not alert.
  • Made the denial threshold tunable and showed how it moves the verdict, because two denials is a mistyped prompt and six is coercion.

Security decisions

  • Weighted device enrolment and source ASN classification heavily, since an unenrolled device on hosting infrastructure is what separates an attack from a user fumbling their own login.

Major challenges

  • Detected the coercion signature specifically: a burst of denials inside a short window terminating in an approval, rather than alerting on denial count alone.
  • Weighted device enrolment and source ASN classification heavily, since an unenrolled device on hosting infrastructure is what separates an attack from a user fumbling their own login.
  • Handled the legitimate-travel case, where a new country plus an enrolled device plus a single clean approval must not alert.

Verified evidence

Results and measurable impact

  • Handled the legitimate-travel case, where a new country plus an enrolled device plus a single clean approval must not alert.
  • Made the denial threshold tunable and showed how it moves the verdict, because two denials is a mistyped prompt and six is coercion.
  • Produced a concrete response action per verdict, from out-of-band user confirmation to session revocation and MFA re-enrolment.
  • Recommended number matching as the structural fix, since detection is a mitigation and the prompt design is the root cause.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

MFA Fatigue Detector

Security platform

MFA Fatigue DetectorWorkspace1 updates
MFA Fatigue Detector · Push Analysisa.reed · coercion likelihood from the prompt sequence
compromise 100

Push-based MFA fails to coercion, not to cryptography. The detectable signature is a burst of rejected prompts ending in an approval, from an unenrolled device on hosting infrastructure. The hard part is not flagging the user who fumbles two prompts on their own phone, which is why device and ASN carry as much weight as the denial count.

Attacker holds a valid password and spams approval prompts until one is accepted.

Prompts

7

6 not approved

Verdict

compromise

score 100

Window

140s

first to last prompt

Source

NL

Cloud VPS

Likelihoodcompromise
100compromise
Prompt sequence7 prompts

Short bars are denials and timeouts, the tall marked bar is the approval. A run of denials terminating in an approval is the coercion signature.

Prompt log
T+0sdeniedNL · 45.83.12.9 · unknown
T+18sdeniedNL · 45.83.12.9 · unknown
T+41stimeoutNL · 45.83.12.9 · unknown
T+63sdeniedNL · 45.83.12.9 · unknown
T+88stimeoutNL · 45.83.12.9 · unknown
T+112sdeniedNL · 45.83.12.9 · unknown
T+140sapprovedNL · 45.83.12.9 · unknown
Scoring

6 rejected prompts followed by an approval inside 140s

prompts originate from an unenrolled device

source ASN is hosting infrastructure, not a consumer or corporate network

country differs from the user's baseline and the device is unrecognised

Action: Revoke the session, force credential reset, re-enrol MFA, and move this user to number matching.

Zain Khalil Khan