hunting-credential-stuffing-attacks

Group failed login events by username and count unique source IPs per account; accounts with more than 50 distinct IPs indicate stuffing. Also check for low global success rates under 1% across many accounts and ASN concentration from cloud or proxy providers.

Group failed logins by source IP and password hash, then count unique usernames per group. Any IP-password combination targeting more than 10 accounts indicates a spray attempt, since legitimate users rarely share passwords across accounts.

Low-and-slow attackers throttle attempts to a few per account per hour spread over days, staying under burst thresholds. Add long-window cumulative counts and a global success-rate signal below 1% instead of relying only on short-window velocity.

Yes, botnets routing through residential proxy networks make each request look like an ordinary home user, defeating ASN and geo-impossibility heuristics. Use request-fingerprint uniformity such as identical user agents, header order, and JA3/TLS fingerprints across diverse IPs instead.

Corporate NAT and VPN egress, password managers retrying logins, and load tests all produce distributed failure patterns that mimic attacks. Allowlist known egress IPs and service accounts, and validate rules against a labeled dataset before deployment.