This was my thought as well, and what I was referring to re: "so many observations on each username" in the parent. The reason this seems unlikely to me is mai

This was my thought as well, and what I was referring to re: "so many observations on each username" in the parent. The reason this seems unlikely to me is mainly rate limits and password lockouts. Plus you're adding a multiple on # of requests for each username you want to try. Say your dictionary has 10,000 usernames (very small IMO). That turns into 10,000,000 requests if you need 1,000 observations on each to control for jitter. Not impossible to find this in the wild, I suppose, but pretty trivial to prevent at any layer.