> Mny password attempts for 1 username, isn't it easier to slow down attempts to authenticate the username after x tries, regardless of the IP? Just the fact th

> Mny password attempts for 1 username, isn't it easier to slow down attempts to authenticate the username after x tries, regardless of the IP? Just the fact that multiple IPs are being used for 1 username in a loop is enough of a red flag. Nope, one attempt per username - they were using a giant list of hundreds of thousands of leaked credentials. > That's half a billion passwords to disallow? Yup.