Credential Brute-Force Against /api/login

02 Requests per Hour

Traffic holds a steady ~25–30 req/hr baseline all day. Hour 03:00 UTC erupts to 173 requests — a ~6× spike driven entirely by 137 failed logins from a single IP.

02b Inside the Burst — Failed Logins per Minute (03:00–04:00 UTC)

Zoomed to the attack hour: 137 automated POST /api/login attempts hammer the endpoint at a machine-steady ~2.6 tries/minute for 53 minutes straight. Every bar is an HTTP 401.

03 Reconstructed Attacker Timeline

Every request below originates from 203.0.113.66. Note the deliberate reconnaissance ~24 minutes before the brute-force burst began.

• 02:41:12 UTC
  Reconnaissance — landed on the homepage

  GET / → 200. First appearance of the IP in the log; scoping the target.

• 02:44:03 · 02:47:55 UTC
  Located the login form

  Two hits on GET /login → 200, three minutes apart — mapping the auth flow and confirming the endpoint before automating.

• 03:05:24 UTC
  Brute-force burst begins

  First POST /api/login → 401. Rapid, scripted credential-stuffing attempts start against the discovered endpoint.

• 03:05 → 03:59 UTC
  137 consecutive failed logins in ~53 minutes

  Sustained automated attack — every single attempt returns HTTP 401. No delay, no CAPTCHA, no lockout slowed it down.

• 03:58:39 UTC
  Attack ends — no successful authentication

  Last attempt still returns 401. Zero 200/OK responses from /api/login for this IP: the credential guessing failed and the account was not compromised.