Total requests
780
All entries in access.log
Meridian Outfitters forensic brief
Credential stuffing burst isolated to one UTC hour.
Source log
30 Jun 2026, UTC
Apache-style access log, parsed locally
The day was quiet except for a concentrated authentication attack from one source. The same IP browsed the site shortly before the burst, opened the login page twice, then generated only failed login attempts for the rest of its observed activity.
Attacker IP
203.0.113.66
Only source of failed login burst
401 POST /api/login
137
Exact failed-login count
Attack hour
03:00
UTC, 30 Jun 2026
Requests Per Hour
Hourly request volume, with the attack hour highlighted in red.
173 requests at 03:00
Reconstructed Timeline
Observed behavior from 203.0.113.66.
02:41:12
Initial visit
Requested GET / and received HTTP 200, likely confirming the site was reachable.
02:44:03
Login page loaded
Requested GET /login and received HTTP 200.
02:47:55
Login page revisited
Requested GET /login again, then paused for roughly 17 minutes before the burst.
03:05:24
Failed login burst begins
Started sending POST /api/login attempts, all returning HTTP 401.
03:58:39
Burst ends without success
The same IP accumulated 137 failed login attempts and no successful login response in the log.
!
Recommended Mitigation
Rate-limit and temporarily lock out login attempts by source IP and account after a small number of 401 responses, with alerting on concentrated failures against POST /api/login.