<p>The emergence of IoT and its applications have enforced different security challenges to identify unauthorized users. Authenticator is one of the applications which is used to provide multi fold security for better robustness. Still there is a possibility that some unauthorized users will try to access the applications. In this article, we present a comprehensive exploration of user-centric analysis and suspicious user detection, specifically focused on the authentication process within the Authenticator application. With cybersecurity being of paramount importance, the study employs advanced machine learning techniques to analyze user interactions and activities, aiming to identify and flag potentially suspicious behavior within individual user accounts. The Authenticator multi-factor authentication system, encompassing email-password, One-Time Password (OTP), and push notification steps, forms the basis for analysis. The study’s motivation lies in safeguarding user accounts from unauthorized access and fraud, necessitating proactive measures against evolving cyber threats. The approach involves processing unstructured, unsupervised data from Elasticsearch and Kafka, extracting valuable insights through feature aggregation, temporal analysis, and geospatial aspects. Evaluation employs the Silhouette Score to measure k-means clustering quality, as well as in the Isolation Forest model, contributing to effective suspicious user detection. During the prediction phase, we retrieve a master dataframe from the SQL database, which contains patterns of both suspicious and normal user behaviors. Utilizing the k-nearest neighbors (KNN) algorithm, we identify the nearest matching pattern from this master dataframe and assign that label to our test data. The study’s outcomes enhance security in the Authenticator application by distinguishing normal and suspicious login patterns, strengthening the multi-factor authentication process for increased reliability.</p>