Rate limiting assumes the attacker comes from a few addresses. Residential proxy networks sell millions, so every attempt arrives from a different IP and no single one looks suspicious.
This is the attack rate limiting is worst at. The defence that survives it is scoring the client rather than the address: the automation stack behind a stuffing run has a recognisable shape even when the IP has never been seen before. ZeroBot returns that signal per request, so a login attempt from a residential proxy running a headless browser is caught on its first try rather than its hundredth. Pair it with a lockout on the account itself, which is the only layer that stops a genuinely distributed attack once one credential pair has been tried dozens of ways.
python (login view)
Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.
Defeated by design. Each credential pair is attempted once from a different residential IP, so no address ever crosses a threshold.
Roughly 1 in 100 attempts succeeds with leaked credentials. Lockout helps, but only after the attempt has been made — and it hands the attacker a way to lock your real users out.
Stops cheap scripts and is solved for cents by services built for exactly this. It also taxes every one of your real users.
Useful, but only tell you a credential was leaked — not whether this request is the attacker or the legitimate owner coming back.
Login is where the damage is worst and a false positive is cheap — the user retries or resets. Tighten it, and keep an audit log so you can see what you blocked.
A distinct block message tells the attacker the credential pair was valid, which is exactly what they are paying the proxy network to find out.
No, run both. Scoring catches the client; lockout is the only thing that limits damage once a correct credential has been found.
Free tier, real verdicts, and documentation with a built-in tester.
Get started free →