What does credential stuffing look like in a store's traffic logs?
Credential stuffing is high-volume login attempts using stolen username and password pairs. In the logs it looks like a spike in failed logins from rotating IPs with a wide user-agent spread and a success rate just above zero.
The signature in the logs
Credential stuffing has a distinctive shape in traffic logs, and once you have seen it, it is hard to mistake for anything else. The core signal is a sudden, sustained spike in POST requests to the login endpoint, orders of magnitude above baseline, with the overwhelming majority returning authentication failures. A store that normally sees two hundred login attempts a day will see twenty thousand in an hour, and 99 percent of them will fail.
The IP distribution is the second tell. The attempts come from hundreds or thousands of distinct IPs, rotating rapidly, often spread across residential proxy networks in many countries. No single IP makes enough requests to trip a naive rate limit, which is the point. The attack is designed to look like a crowd of individuals rather than one machine.
The user-agent spread is the third. Real login traffic clusters around a handful of current browser versions. Stuffing traffic shows a long tail of user agents: outdated browsers, mismatched OS and browser combinations, headless client signatures. The operators rotate user agents to dodge fingerprinting, and the rotation itself becomes the fingerprint.
How it differs from brute force
Brute force tries many passwords against few accounts. Credential stuffing tries many accounts with few passwords each, using real credential pairs leaked from other breaches. The distinction matters because the defenses differ. Brute force is defeated by account lockouts and slow hashes. Stuffing laughs at lockouts because it never hits the same account twice in a row.
In the logs, brute force shows as repeated attempts against a small set of usernames, often administrator or common names. Stuffing shows as a broad spray across the username space, each username attempted once or twice. If your failed-login report shows the same five usernames thousands of times, that is brute force. If it shows thousands of usernames a few times each, that is stuffing.
The timing differs too. Brute force is often slow and persistent, running for days. Stuffing is bursty: the operators hold a fresh credential list and burn through it fast, because lists decay as victims change passwords. A stuffing wave typically lasts hours, not days, and then the IPs go quiet.
What the success rate tells you
The uncomfortable metric is the success rate. Credential stuffing works because people reuse passwords: typically a fraction of a percent to a few percent of attempts succeed. In the logs that looks like a small but nonzero number of successful logins amid the sea of failures, often followed immediately by account behavior changes: password resets, shipping address changes, gift card purchases.
Track the success rate per wave, not just the attempt volume. A wave with a 0.1 percent success rate is background noise. A wave with a 2 percent success rate means the credential list is fresh and high quality, and the accounts that fell need immediate attention: forced password resets, session invalidation, and a review of post-login actions.
Correlate successful logins with IP reputation data. Successful stuffing logins disproportionately come from the same proxy networks as the failed attempts. If a "successful" login comes from an IP that made five hundred failed attempts in the previous hour, treat the account as compromised regardless of what the user says.
What to do when you spot it
First, contain: rate-limit the login endpoint aggressively, require a CAPTCHA or equivalent challenge on login after a failure threshold, and consider forcing re-authentication for sessions created during the wave window. These are emergency measures; tune them back after the wave passes.
Second, protect the accounts. Force password resets for accounts with successful logins from suspicious IPs during the window. Invalidate sessions. Review orders and account changes from those accounts for fraud. The fraud usually follows within hours, so speed matters more than completeness.
Third, fix the structural gap. Credential stuffing succeeds against password-only authentication. Multi-factor authentication, passkeys, and breached-password screening at registration and password change all cut the success rate dramatically. The wave in your logs is the business case for the authentication upgrade the roadmap keeps deferring. Use it.