This interests me a lot as we do security but don't run a big service ourselves and so don't have data on what motivated attackers' behavior is exactly. How ma

This interests me a lot as we do security but don't run a big service ourselves and so don't have data on what motivated attackers' behavior is exactly. How many active users (to an order of magnitude; no need for precise numbers of course) does this service have? 100k IPs sounds pretty costly to burn, so I'm curious how important one needs to be before that's considered worth it. And could you say what type of IP addresses those were? Did it look residential such as from compromises computers (botnet), do they rent lots of IP addresses temporarily from aws/netcup/alibaba, or is it a mix such that neither category has the overwhelming majority? If it's all server IP ranges for a service where end users normally log in, you could apply entirely different rate limits to those than to residential IPs, for example. Hence I'm wondering how these cred stuffing attacks are set up