A fintech login page drowning in credential-stuffing

A fintech login page drowning in credential-stuffing

A neobank saw its origin login endpoint hit 800 requests/second from a stuffing campaign rotating through stolen passwords. The PHP auth handler couldn't keep up, real users got 503s, and the database connection pool exhausted twice in one night. The attack traffic looked like normal POSTs, so it sailed straight to origin.

The defense was on the wrong side of the network.

What we changed: moved rate limiting to the edge — 5 login attempts per IP per minute, with a managed challenge on the sixth, plus a bot-score block on known stuffing fingerprints. Legit users never saw friction; the campaign hit a wall at the POP.

Malicious requests reaching origin dropped from 800/s to under 4/s. The auth database load fell 96%. Real-user login success rate during the attack recovered from 71% to 99.3%.

The number that mattered: 800/s to 4/s reaching origin.