Most modern credential stuffers use headless browsers with all the bells and whistles, html5, javascript, etc. Login attempts are usually spread over a massive

Most modern credential stuffers use headless browsers with all the bells and whistles, html5, javascript, etc. Login attempts are usually spread over a massive botnet of residential IPs as well, where they'll only use each IP for one or two login attempts before moving on to the next. It's a very fascinating problem space