# Why bots keep hammering your login page (and what the logs show) | Bot Traffic Index

Source: https://bottrafficindex.com/blog/2026-10-08-bot-traffic-login-page-attacks.html

Oct 8, 2026 - Bot Traffic Index


Check the traffic on any store's login endpoint and you will find the bots outnumber the humans, sometimes by orders of magnitude. Login pages are the highest-value target on the site: one compromised account means stored payment methods, order history, and loyalty points. The attacks come in flavors, and each flavor writes its own signature into the logs.

## Credential stuffing: the volume play

Credential stuffing uses stolen username and password pairs from other breaches, betting that people reuse credentials. In the logs it looks like a flood: thousands of login attempts in a short window, each with a different username, each with a different password, rotating through IPs and user agents to dodge simple rate limits. The success rate is tiny, well under one percent, but the volume makes it profitable. One thousand attempts at a 0.1 percent success rate is one compromised account, and the botnets run millions of attempts.

The tell is the credential diversity. A legitimate traffic spike shows the same users retrying. Credential stuffing shows different users every time, because each attempt is a new stolen pair. If your failed-login log shows a thousand unique usernames in ten minutes, that is not a rush of forgetful customers. That is a stuffing run.

## Password spraying: the quiet one

Password spraying inverts the approach: instead of many passwords against many accounts, it tries a few common passwords against many accounts. Winter2024, Password123, the store name plus 123. In the logs it is quieter than stuffing, a steady drumbeat rather than a flood, which is exactly why it works. Rate limiters tuned for volume miss it. It spreads attempts across hours or days, staying under the thresholds that trigger alarms.

The signature is the password repetition. Different usernames, same handful of passwords, evenly paced. Legitimate users do not fail logins with the same three passwords across hundreds of accounts. If your logs show password clustering like this, the spray is already running, and the accounts with weak passwords are already identified. Forcing a reset on affected accounts matters more than blocking the IPs, because the attacker already has the list of which accounts exist.

## Account takeover probes: the targeted ones

The most sophisticated attacks do not spray at all. They probe specific high-value accounts: ones with stored payment methods, high loyalty balances, or admin access. These show up as low-volume, high-patience attempts from residential IPs, sometimes one attempt every few minutes for days. They mimic human behavior deliberately, and simple bot detection misses them entirely.

The giveaway is the session behavior around the attempt. Probe traffic often requests the account page or the stored payment page before attempting login, mapping what the account contains. It may also test the password reset flow rather than the login form, since reset tokens bypass some login protections. Correlate login attempts with adjacent endpoint traffic and the targeted pattern emerges.

## What to do about it

The fundamentals still work. Rate limit the login endpoint aggressively: legitimate users rarely fail five logins in a minute. Require CAPTCHA or equivalent challenge after a small number of failures, not after dozens. Alert on the signatures above, not just on volume, so the quiet spraying gets caught too. And treat credential diversity in failed logins as an attack indicator on its own, because it is.

Multi-factor authentication is the structural fix. Every attack described here assumes the password is the only barrier. MFA turns a successful password guess into a dead end. Push it hardest on accounts with stored payment methods and admin roles, where the payoff of a takeover justifies the friction. The bots will keep hammering the login page regardless. The question is whether the hammering can ever succeed, and MFA is what makes the answer no.

## Frequently asked questions

### Why do bots target login pages so heavily?

Because accounts are valuable: stored payment methods, loyalty points, and personal data sit behind them. Credential stuffing uses passwords leaked elsewhere, betting on reuse, and login pages are where that bet gets placed at scale.

### What do login attacks look like in the logs?

High volumes of failed logins, attempts spread across many accounts from rotating networks, and success rates far below human patterns. Spikes outside normal shopping hours and against old, dormant accounts are especially telling.

### How can stores defend login pages without locking out customers?

Rate limits, breached password screening, and step up checks only when signals look wrong. Defenses that challenge every login punish real customers, while risk based checks concentrate friction on the traffic that deserves it.