[ryantriangles]

With credential stuffing, isn't it unlikely the perpetrator wants to make more than one or two attempts per user ID?