Credential Stuffing Detection

The fundamental first line of defense against credential stuffing, measuring the frequency of login attempts from a single source over time. Detection engines track requests per second (RPS) per IP address, device fingerprint, or session token. A single IP attempting hundreds of logins per minute—far exceeding human capability—triggers an immediate block. Advanced implementations use exponential backoff and sliding window counters to differentiate between a legitimate user who forgot their password and a bot cycling through a combo list. Effective velocity checks correlate rate anomalies across multiple dimensions simultaneously, such as IP + User-Agent + target account, to reduce false positives from shared NAT gateways.

A statistical signal that monitors the ratio of failed to successful login attempts across a monitored population. Credential stuffing attacks, which rely on breached username/password pairs from unrelated services, typically exhibit a failure rate exceeding 95% . Detection systems track this metric globally and per-target account. A sudden spike in HTTP 401 or HTTP 403 responses against a specific authentication endpoint is a high-fidelity indicator of an ongoing attack. Sophisticated attackers attempt to evade this by interleaving valid logins, making it essential to analyze failure rates using short-burst time windows rather than long-running averages.

The passive identification of automated clients by probing for non-human environmental artifacts. Detection techniques include:

• WebDriver Detection: Checking for navigator.webdriver property set to true.
• Headless Browser Detection: Testing for missing rendering outputs like navigator.plugins.length == 0 or inconsistent window.chrome objects.
• Canvas Fingerprinting: Rendering a hidden graphic to detect subtle GPU and driver stack variations unique to headless environments.
• TLS Fingerprinting: Analyzing the JA3/JA4 hash of the TLS handshake to identify known automation toolkits like curl, python-requests, or Go-http-client.

A critical distinction in attack classification that dictates the response strategy. Credential stuffing uses many usernames with a few known passwords per account (breached pairs), resulting in a high failure rate per account but low lockout risk. Password spraying uses a few common passwords against many usernames, resulting in a low failure rate per account to avoid lockout thresholds. Detection systems must differentiate these by analyzing the cardinality of passwords per username and the dispersion of targets. Stuffing shows a 1:1 or 1:few password-to-username ratio, while spraying shows a 1:many ratio.

A geolocation-based signal that flags logins when the physical distance between two successive access points cannot be traversed in the elapsed time. For credential stuffing, attackers often route traffic through globally distributed proxy networks. A successful login from New York followed by a failed attempt from Moscow 5 minutes later triggers an impossible travel alert. The core calculation is distance / time > max_feasible_speed. This signal is particularly effective when combined with IP reputation databases that identify known VPN exit nodes, TOR relays, and cloud hosting provider IP ranges frequently used in automated attacks.

The process of assigning a persistent, anonymous identifier to each connecting device by hashing a combination of attributes—browser version, OS, installed fonts, screen resolution, timezone, and WebGL renderer. During a credential stuffing attack, a single device fingerprint may attempt logins for hundreds of distinct accounts, a behavioral pattern impossible for a legitimate user. Detection engines maintain reputation scores for each fingerprint, dynamically downgrading trust when a fingerprint exhibits high velocity, high failure rates, or association with known attack infrastructure. Unlike IP-based blocking, fingerprinting survives proxy rotation.

The primary detection mechanism for credential stuffing, velocity checks monitor the rate of login attempts across multiple dimensions—IP address, device fingerprint, and target account. A sudden spike in failed logins from a single source, often exceeding hundreds of requests per second, triggers automated blocking. Advanced implementations use sliding time windows and adaptive thresholds that distinguish between a legitimate user forgetting a password and a botnet cycling through breached credentials. Key metrics include login attempts per second per IP, failure rate per session, and distinct usernames attempted per device.

A passive identification technique that collects dozens of device attributes to generate a unique, persistent identifier for each connecting client. Attributes include browser version, operating system, installed fonts, screen resolution, WebGL renderer hash, and canvas fingerprint. In credential stuffing detection, device fingerprints reveal when a single machine is attempting logins across hundreds of accounts—a pattern invisible to IP-based detection alone. Canvas fingerprinting exploits subtle GPU and driver variations to create highly stable identifiers that survive cookie clearing and incognito mode.

The measurement and analysis of unique patterns in human physical and cognitive actions that distinguish genuine users from automated scripts. For credential stuffing defense, behavioral biometrics provide a critical layer beyond credentials:

• Keystroke dynamics: Dwell time and flight time patterns that bots cannot replicate naturally
• Mouse dynamics: Acceleration curves and trajectory entropy that reveal scripted movements
• Touchscreen pressure: Mobile interaction patterns absent in emulators These passive signals enable continuous authentication throughout a session, detecting account takeover even after a bot successfully authenticates with valid stolen credentials.