We see credential stuffing quite a lot, with attacks varying from the blatantly obvious (1000s of requests in a minute, to the login page, from the same IP, wit

We see credential stuffing quite a lot, with attacks varying from the blatantly obvious (1000s of requests in a minute, to the login page, from the same IP, with a scripting UserAgent like python-requests) to highly distributed attacks across 100s of IPs with a random but current useragent. While some malicious folk do this all manually and write their own scripts, tools like those mentioned in Troy's post are pretty common. One mentioned that I'd like to call out is SentryMBA - this tool is easily adapted to any business via a shareable config, written by anyway. Want to know if your service is probably affected or targeted? Google "Sentry MBA" + your businesses name. There are trading forums for these configs, and they range from banks and big businesses, to CRMs and utility services. SentryMBA also has the ability to scare certain information on a successful login, helping to identify those key accounts that'll earn you more on the black market, such as recent successful orders on Amazon, or a high number of points on Starbucks accounts. If you've got a business with an online login page, it's well worth checking the logs these types of attacks, to see if any of your users or even employees need to have their passwords reset after being successfully popped from a credential stuffing attack.