Data analysis report classifies account-verification requests as 40% of elevated-risk login activity but did not disclose request volumes or customer composition

Based on a data analysis of login attempts, account activity, and fraud detections observed through its services (as well as data supplied by a third party firm, Bolster AI), a US-based provider of content delivery, cybersecurity, and distributed cloud-computing services has released findings on regional risk classifications, scam and phishing detections, and account-lifecycle abuse to the media.

First, 36.4% of login attempts observed through its own services  in the Asia-Pacific region were classified as high or critical risk during a 30-day sample between July and August 2026. The comparable shares were 37.8% in Latin America, 23.7% in EMEA, and 23.6% in North America; high- and critical-risk attempts accounted for 26.6% of all recorded attempts in the sample. Akamai characterized these classifications as suggesting a likelihood of brute-force or credential-stuffing attempts, rather than confirmed successful attacks.

Second, account-verification requests accounted for 40.0% of high- and critical-risk login activity in the same sample. The firm characterized this as potentially consistent with attempts to determine whether email addresses were associated with valid accounts before credential-stuffing activity; however, the report did not establish that the requests were attacks.

Other findings

Third, detections of online scams in Bolster AI data had increased from approximately 3.2m to approximately 6.4m during the July 2025-to-June 2026 reporting period, and had exceeded Bolster AI’s detections of traditional phishing in Q1 2026. The report did not provide detection criteria, a denominator, or victim-loss data for the comparison. Other report data:

• Bolster AI data indicated that the average phishing-attack lifespan was 48.3 days in Q4 2025 and 22.0 days in Q2 2026. The report did not disclose how campaign lifespans were delimited or whether methodology changed between the two quarters.
• DNS telemetry for 1 January 2026 to 31 July 31 2026 indicated that banking accounted for 6.4% and fintech for 6.1% of attack activity in APAC, totaling 12.5%. The report did not define the operational criteria for “attack activity” or state whether blocked, suspicious, and confirmed events were included.
• The report described simultaneous activity against an unnamed large APAC financial institution beginning 29 July 2026: approximately 42,000 requests over seven days, which was characterized as likely intended to validate personally identifiable information; and 164 requests, which it characterized as low-volume account-creation activity likely intended to evade detection thresholds. The report did not identify the institution or publish the underlying evidence.
• Bolster AI research had analyzed 2,157 URLs connected to campaigns that used travel-related search queries to redirect users to South-east Asian gambling platforms. The report said the campaigns targeted cryptocurrency investors, financial institutions, consumer brands, and commerce platforms, but did not provide a breakdown by target type or outcome.
• The report did not disclose the number of login attempts, platform customers, end-user organizations, or the customer and industry composition of the data sample underlying the regional login-risk percentages.

According to Reuben Koh, Director, Security Technology and Strategy (APJ), Akamai, the firm that shared its data analysis, “… What looks like a routine login, a new account or a small payment could be part of a larger attack … suspicious activity does not always look suspicious in isolation.”

*Methodology note: The login-risk findings were based on a 30-day sample from Akamai Account Protector between July and August 2026. Account Protector used machine learning and risk and trust indicators to classify requests; the report did not disclose the number of login attempts, customers, organizations, or sample composition. Regional DNS-threat findings were based on Akamai Secure Internet Access telemetry from January 1 to July 31, 2026. Phishing and online-scam findings were based on data supplied by Bolster AI from July 2025 through June 2026. “High” or “critical” risk indicated Akamai’s classification of potentially adversarial activity, not a confirmed successful attack.