Two Tries Each

Over 24 hours you record 400,000 login attempts spread across 380,000 distinct accounts. Almost no account is tried more than twice, sources span roughly 40,000 residential proxy addresses, and about 0.4% of attempts succeed. Which control actually addresses this account takeover campaign?

Rotate the session cookie name and require a per-form CSRF token on login, so a scripted POST that never fetched the form is rejected before authentication runs and never reaches the credential check

Treat it as credential stuffing and defend at the population level: score device and network fingerprints across accounts, screen passwords against breach corpora, and step up verification on unknown devices

Lock each account after five consecutive failed attempts, the standard answer to password guessing, email the owner whenever a lockout fires, and require a support-assisted reset before the account unlocks again

Cap the login endpoint at ten attempts per minute per source address, drop anything above that ceiling with a 429 response, and add a Retry-After header so well behaved clients back off before the next window