The reliable way to detect credential stuffing is to correlate NGINX requests with authentication outcomes from your application or identity provider. NGINX can show bursts, source addresses, routes, user agents and response codes, but it cannot inherently tell whether a username-and-password pair was accepted. Look for unusual failed-login activity across accounts, clients, time windows and routes, then confirm suspicious requests against authoritative success and failure events.
This guide explains what to log, which patterns matter, how to investigate them without a universal threshold, and how to respond without exposing credentials or accidentally creating a denial-of-service condition.
As an Amazon Associate I earn from qualifying purchases.
What credential stuffing is—and how it differs from other attacks
Credential stuffing is the automated testing of stolen username-and-password pairs against another service. OWASP’s Automated Threats to Web Applications Project describes it as “Mass log in attempts used to verify the validity of stolen username/password pairs.” The attacker is not guessing randomly; they are replaying combinations obtained from an earlier breach or another source.
Recommended Free Tools
The distinction changes what you should expect in logs:
#1 Best Overall
| Attack type | Typical credential pattern | Useful log clue |
|---|---|---|
| Credential stuffing | Many username/password pairs, often each attempted once or a few times | Several account identifiers from one apparent client, or the same accounts spread across many clients |
| Brute force | Many passwords tried against one account | Repeated failures concentrated on a single account |
| Password spraying | One or a small set of common passwords tried against many accounts | A shared timing or client pattern across a broad account list |
These are investigative patterns, not proof of attribution. A defective mobile client, a password manager problem or a legitimate corporate login burst can resemble an automated attack. Treat the pattern as a lead until application events and surrounding account activity confirm what happened.
Know what each NGINX log can and cannot prove
Access logs provide request context
NGINX access logs are written after request processing. The access_log directive selects the destination and format, while log_format defines the variables recorded. A useful authentication-focused format normally includes the client address, timestamp, request line, status, response size, referrer and user agent. Add a request identifier when your deployment provides one.
http {
log_format auth_context '$remote_addr - $request_id [$time_iso8601] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log auth_context;
}The snippet is an example format; adapt the destination, fields and privacy controls to your deployment. Protect access logs because addresses, paths, headers and account-related query data can be personal or security-sensitive. Do not add passwords, session secrets or complete authorization tokens.
HTTP status is only a proxy for authentication outcome
A 401, 403 or application-specific error may correlate with a failed login, but only if your application uses that response consistently. A successful-looking 200 does not prove that authentication succeeded: a login form may return the same status when it displays an error, and a single-page application may submit the result through another request. The authoritative record is the application or identity provider’s authentication event.
Error logs answer a different question
The NGINX error log records NGINX messages and severity. It is valuable for diagnosing upstream failures, configuration errors and infrastructure problems, but it is not a replacement for access records plus authentication events. A quiet error log does not mean that login abuse is absent.
Build the evidence you need before investigating
Inventory every authentication route
List the normal login endpoint and related routes: API login methods, single sign-on callbacks, token exchanges, password-reset requests, account unlock operations and MFA verification. Attackers may shift between routes when one is rate-limited. Record the HTTP method and the expected response behavior for each route.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Define an outcome vocabulary
Ask the application or identity team to emit explicit outcomes such as failure_invalid_password, failure_unknown_account, failure_locked, success and mfa_challenge. Use a stable event name and timestamp. This prevents analysts from inferring success from a generic status code.
Free tools Windows power users keep installed
One-click scans. No signup required.
Correlate requests with application events
Pass a request or correlation ID from NGINX to the upstream application when possible, and include it in both records. If an ID cannot pass through every component, correlate on a narrowly bounded timestamp, route, method and client signal. Clock synchronization matters; use a consistent time basis and document the tolerance used during searches.
A security event should contain the minimum data needed for detection and response. An account key can be pseudonymized or hashed consistently for aggregation, while access to the mapping remains restricted. Never log the submitted password, password-derived material, session cookies or bearer tokens.
Consider identity-provider and WAF events
Central identity systems can provide MFA, lockout, reset and successful-login events that NGINX does not see. A NGINX-compatible web application firewall may add bot attributes and policy decisions. F5’s NGINX WAF documentation describes failed-login counting by IP address or username, with policy actions such as logging, blocking or challenges. Those capabilities are product- and version-specific, so verify the installed edition and policy behavior before treating a WAF event as evidence.
Signals that should trigger an investigation
A sudden rise in failed authentication
Compare failed outcomes on each authentication route with the application’s normal activity for the same hour, day-of-week and traffic conditions. A spike on one API route can be hidden by normal traffic elsewhere. Monitor both the absolute number of failures and the failure rate among login attempts. There is no universal number that separates an attack from normal use.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Many accounts from one apparent client
Group failed events by source address and count distinct account identifiers. A short sequence of different accounts from one address, user agent or device fingerprint is an indicative stuffing pattern. NAT gateways, mobile carriers and corporate proxies can put many legitimate users behind one address, so combine the address with timing, route, user agent and application outcome.
One account targeted by many clients
Aggregate failures by account key and count distinct source addresses, user agents and device signals. A single account receiving rapid attempts from many networks may indicate a distributed attack, a targeted takeover attempt or a user who is repeatedly entering an old password across devices. Check whether the account later records a successful authentication, MFA change, password reset or lockout.
Sequential attempts with changing credentials
OWASP identifies sequential login attempts with different credentials from the same HTTP client as an indicative symptom. In practice, sort events by time and inspect whether the account key changes on nearly every request while the route, client signature or header pattern remains stable. A rotating proxy may change addresses while preserving other automation fingerprints; a shared browser may do the opposite.
Distributed, low-rate activity
Attackers can spread requests across many addresses so that no single source exceeds a per-IP limit. Search across the account dimension, authentication route, time window, user-agent families, device or fingerprint signals and common header patterns. A low request count per address is not reassuring when the combined activity is abnormal.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Successful logins mixed into suspicious failures
A success inside a burst of anomalous failures raises urgency, but confirm it from the application or identity provider. Do not classify every HTTP success as a valid login. After a confirmed success, inspect MFA prompts, new-device records, session creation, password changes, recovery requests and high-risk actions on the account.
Changes in automation and timing
Look for regular inter-request intervals, synchronized bursts, unusual header combinations, sudden user-agent churn or a client signature appearing across unrelated accounts. These signals are strongest when they depart from your own baseline. They are not reliable as single-factor proof because accessibility tools, SDKs, corporate software and browser updates can also change headers and timing.
A step-by-step NGINX credential-stuffing investigation
- Confirm the routes. Identify the exact login, token, SSO, MFA and recovery paths. Note methods, expected status behavior and the upstream service handling each request.
- Verify event coverage. Confirm that NGINX records requests and that the application or identity provider records explicit authentication successes and failures. If either side is missing, fix the instrumentation before relying on a detection rule.
- Add correlation. Propagate a request ID where possible. Otherwise record synchronized timestamps, route, method and a privacy-preserving client key so that a request can be matched to an authentication event.
- Set a local baseline. Measure normal attempts, failure rates, distinct accounts per client, distinct clients per account and burst timing by route and time period. Keep separate baselines for interactive web login, mobile APIs, service accounts and automated integrations.
- Search multiple dimensions. Start with a suspected window, then group by source address, account key, route, user agent, device or fingerprint signal and time bucket. Look for both concentration and dispersion: many accounts from one client, or one account from many clients.
- Join outcomes to requests. Mark each request with the application outcome when available. Separate invalid-password failures from locked-account responses, MFA challenges, successful authentication and infrastructure errors. This prevents an upstream outage from being mistaken for credential stuffing.
- Check for account impact. For confirmed successes, review new sessions, MFA changes, password resets, recovery events and sensitive actions. Preserve the relevant NGINX, application and identity records under your incident process, observing retention and access policies.
- Test alternative explanations. Contact the service owner about client releases, scheduled tests, identity-provider incidents, corporate egress changes or known user migrations. A suspicious event is not automatically an attack.
- Apply proportionate controls. Use MFA or step-up authentication for risky circumstances, and tune login limits, delays or challenges. Test the control with legitimate clients so that throttling does not create a denial-of-service condition.
Queries and dashboards that expose the pattern
The field names below are illustrative. Adapt them to your log pipeline and keep the account key pseudonymized where full identifiers are not necessary.
-- Failures by client and number of accounts
SELECT time_bucket, client_key,
COUNT(*) AS failures,
COUNT(DISTINCT account_key) AS accounts
FROM auth_events
WHERE outcome LIKE 'failure%'
AND route IN ('/login', '/api/login')
GROUP BY time_bucket, client_key;
-- Accounts receiving failures from many clients
SELECT account_key,
COUNT(*) AS failures,
COUNT(DISTINCT client_key) AS clients
FROM auth_events
WHERE outcome LIKE 'failure%'
GROUP BY account_key;Use a dashboard to compare these values with the baseline rather than displaying a single global alarm threshold. Useful panels include attempts and failures by route, failure rate over time, distinct accounts per client, distinct clients per account, confirmed successes following failures, and MFA or reset events following a suspicious window.
Comparing detection sources
| Approach | Authentication outcome coverage | Dimensions available | Distributed low-rate detection | Main risk or limitation |
|---|---|---|---|---|
| NGINX access log alone | Usually indirect; status codes are only a proxy | Address, time, route, method, status, headers and user agent, depending on format | Limited unless logs are aggregated centrally | Cannot inherently prove that credentials were accepted or rejected |
| Application or identity events alone | Authoritative when outcomes are emitted consistently | Account, outcome, MFA, reset and session data, depending on the system | Good for account-centric correlation; source context may be incomplete | May omit proxy, header and request details visible at NGINX |
| Correlated NGINX plus application events | Request context joined to authoritative outcomes | Address, route, account, outcome, timing and client signals | Strongest of these options when aggregation is centralized | Requires consistent IDs, clock alignment and careful data protection |
| NGINX-compatible WAF or bot policy | Depends on the product policy and integration | May include bot attributes, failed-login counts and policy decisions | Can help with IP- or username-based distribution, subject to policy scope | Edition, version and policy behavior must be verified; false positives can block users |
The sources do not establish a universal score, cutoff or ranking for these approaches. Choose based on whether you need authoritative outcomes, broad aggregation, distributed-traffic visibility, manageable false positives and data minimization.
Why simple rules fail
Per-IP thresholds miss distributed attacks
A limit applied only to one address can be bypassed by rotating sources or using large residential and cloud pools. Keep per-IP controls as one layer, but correlate the same route and account population across all observed clients.
Status-code rules misclassify application behavior
Some applications return 200 for both a displayed login error and a successful page; others return 401 for an expired session unrelated to a password attempt. Map outcomes from application events instead of assuming a status-code meaning.
Address-only identity is unreliable
Shared networks create false positives, while proxies and bot infrastructure make addresses easy to rotate. Combine address with account spread, timing, user-agent families, device or fingerprint signals and route.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteLegitimate bursts look hostile
Release-day traffic, a corporate password-policy change, a broken client update or an identity-provider outage can generate many failures. Compare with known changes and inspect whether failures are concentrated in one client version or accompanied by upstream errors.
Best Value
Logging too much creates a second risk
Passwords, tokens and session secrets should never be placed in NGINX or application logs. Restrict access, encrypt transport and storage where appropriate, define retention, and remove unnecessary personal data. A hashed account key can support grouping without exposing the original identifier to every analyst.
Response and prevention after confirmation
Protect accounts with stronger authentication
Require MFA or step-up verification when risk is elevated, especially after a confirmed suspicious success or a sensitive account change. Review recovery channels because an attacker who cannot pass MFA may attempt password reset or account-recovery flows instead.
Throttle carefully
Login limits, progressive delays and challenges can reduce automated attempts. Tune them by route and risk, monitor legitimate completion rates, and provide a recovery path for locked-out users. OWASP cautions that throttling must not become an easy denial-of-service mechanism against an account or a shared client network.
Use layered signals
Combine account, client, route and timing dimensions rather than blocking on one field. A policy can log first, challenge uncertain traffic and block only when multiple signals align. Keep an audit trail of the rule, evidence and action so that a false positive can be reversed.
Preserve evidence and communicate scope
Retain the relevant request and authentication records according to your incident policy. Document the time window, affected routes, number of distinct accounts and clients, confirmed successes, controls applied and remaining uncertainty. Do not claim compromise solely because a suspicious pattern appeared; distinguish attempted stuffing, confirmed authentication and confirmed account misuse.
Quick Recap
A compact operational checklist
- Login, token, SSO, MFA and recovery routes are inventoried.
- NGINX access logs include the fields needed for route, timing and client analysis.
- Application or identity logs record explicit authentication outcomes.
- Requests and auth events share a correlation ID or a documented timestamp-matching method.
- Passwords, tokens and unnecessary personal data are excluded from logs.
- Baselines exist for each route and major client population.
- Dashboards aggregate by account, client, route, time and automation signals.
- Rules account for distributed low-rate activity, not only per-IP volume.
- Confirmed successes are checked for MFA, reset, session and sensitive-account activity.
- Analysts test client defects and legitimate bursts before declaring an attack.
- Mitigations use layered limits, challenges or MFA without creating avoidable denial of service.
- Retention, access control and incident-preservation requirements are documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
