TNG RiskOps Agent
Account takeover operations workspace
Dormant wallet | Wallet MY-2191 | Penang
Timeline first. Then what was attempted. Then what is still missing.
| Time | Event | Result |
|---|---|---|
| 15:18 | Dormant wallet reactivated First login in 63 days | Completed |
| 15:22 | New payee added Same session as reactivation | Completed |
| 15:24 | Step-up required Challenge failed twice | Blocked |
Keep the proof tight. Facts first, interpretation second, network signals after that.
| IP signal | Geo / ASN | Flags | Linked cases |
|---|---|---|---|
45.126.112.7 Commercial VPN egress First-seen wallet reactivation came through a VPN path not present in prior good logins. | Penang, MY AS138997 EdgeNet Transit | HIGHWatch | CASE-ATO-008 |
118.101.92.15 Known-good historical broadband Customer's last good session used this home broadband IP, not the current VPN route. | Penang, MY AS4788 Telekom Malaysia | LOWAllowlisted | CASE-ATO-008 |
Move the bulky cards into a proper table so operators can scan source and policy coverage faster.
| Evidence | Kind | Source | Policy |
|---|---|---|---|
Dormant wallet reactivated No user activity for 63 days before this login. | FACT | wallet_activity 2026-04-25T15:18:00+08:00 | POL-ATO-02 |
Step-up challenge failed Two consecutive re-login challenges failed. | FACT | auth_events 2026-04-25T15:24:00+08:00 | POL-ATO-02 |
New payee added New payee created before attempted top-up. | FACT | beneficiary_events 2026-04-25T15:22:00+08:00 | POL-OPS-02 |
VPN-backed login path The reactivated session came from a VPN egress path rather than the user's known-good broadband IP. | FACT | network_graph 2026-04-25T15:19:00+08:00 | POL-ATO-02 |