The Scale of Credential Stuffing

The author of the post operates one of the world's largest honeypots, primarily used for large-scale credential stuffing attacks and, to a lesser extent, for credit card testing. They observe over 130 million authentication attempts (stuffs) per day, which amounts to approximately 1500 per second, targeting tens of thousands of websites. On average, they note around 500,000 successful authentications per day, with roughly half of these being IMAP accesses to victims' email accounts.