Six IPs, one browser string, two logins that worked
Login failures arrive from rotating IPs with an identical user agent. Count the sources, find the two redirects that mean success, and match them to accounts in the application log.
Briefing
The shop’s login endpoint saw a burst of 401s overnight. No single IP sent enough to trip the rate limit.
Credential stuffing replays username and password pairs leaked elsewhere, spread across many IPs. The login page answers 401 on failure and 302 (redirect to the account page) on success.
shop-web-01 · Web server logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.