@cR0w @jerry for this circumstance, the right infrastructure is "just logging". so long as the logs contain things like source ip, user they tried to auth as, user agent, and timestamp - just those alone, across a few hundred million lines of log data will show you way more than you expect.
@Viss @cR0w It's a good idea for a project. I'll have to see if there is a way to get Fastly to create logs that contain that sort of information, else I'll have to join up a few different sources.
@jerry @Viss @cR0w if you have the time and are willing to spend it on such a project, you could consider reaching out to @NGIZero they give you grants to open source project that make the internet a better place!