OpenBullet automates repeated login checks against websites and is widely abused to test stolen or guessed credentials at scale.
Configurations describe how a site sign in responds, and criminals aim those checks at pairs of usernames and passwords taken from other breaches.
How it works
The harm is account takeover and locked out customers when a password reused from another site still works on yours.
Defenders see bursts of login attempts that follow a mechanical pace, succeed rarely, and then pivot to password resets or payment changes.
This page names the tool and the abuse, and it does not explain how to write a configuration or how to obtain credential lists.
Useful defenses assume the password may already be known elsewhere and make a second, phishing resistant check and a rate limit carry the weight.
Concrete examples
- A shop sees thousands of login attempts per minute that fail, then a handful of successes on accounts that reused a breached password.
- Successful logins from the wave immediately change the payout email before the real customer notices.
- A status page for the tool's traffic is unnecessary, yet the login logs show one user agent pattern across many addresses in the same hour.
Protective measures
- Rate limit and challenge login attempts that fail in volume, and do it without publishing the exact thresholds attackers should expect.
- Require a second check that does not depend only on a password that may already be public.
- Notify customers of a new login and let them revoke the session from a trusted device.
- Watch for a successful login followed at once by a payout, email, or password change.
How CDPCaptcha helps
Proof of work raises the cost of automated account checking because every config driven attempt must spend computation before it can continue.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.
Related articles
The broader attempt to learn or guess a secret is explained in What is a password attack against the secret of an account?.
A windowless browser that scripts can drive during automated visits is described in What is headless Chrome in browser automation without a window?.
Defeating the extra login check after a password is known is covered in What is MFA bypass against an extra check at sign in?.