Failed login heatmap generator
Why Choose This Project
Monitoring failed login attempts is crucial for identifying brute-force attacks, credential stuffing, and other unauthorized access attempts. A simple log file or table may not reveal patterns quickly. This project visualizes failed login activity across time and locations using interactive heatmaps, enabling administrators to quickly spot attack trends, peak periods, and targeted accounts.
What You Get
A system that tracks all failed login attempts in real time, aggregates data based on user, IP, location, and time, and presents it in a dynamic heatmap dashboard. Administrators can detect suspicious behavior patterns, configure alerts, and export reports for compliance or investigation purposes.
Key Features
| Feature | Description |
|---|---|
| User Authentication | Admin login to access failed login analytics securely. |
| Failed Login Tracking | Track failed login attempts with timestamp, username, IP, and device info. |
| Heatmap Visualization | Display failed login frequency by hour, day, week, or location. |
| Geolocation Mapping | Map IP addresses to cities/countries on an interactive map. |
| Time-Based Filtering | Filter heatmaps by specific time ranges or periods. |
| Alert System | Email/SMS notifications for suspicious login patterns. |
| Reporting Module | Export heatmap data and summaries in CSV/PDF formats. |
| Dashboard Insights | Identify targeted accounts, repeated attack IPs, and peak attack times. |
| Interactive UI | Hover to view details for each point on the heatmap. |
| Historical Analysis | Maintain logs for trend analysis and incident review. |
Technology Stack
Frontend Layer
- HTML, CSS, JavaScript
- Bootstrap for responsive UI
- Chart.js / D3.js / Leaflet.js for heatmap visualization
Backend Layer
- Node.js (Express) / Java Spring Boot / Python Flask
- Handles logging, aggregation, and alert notifications
Database Layer
- MongoDB / MySQL / PostgreSQL to store failed login attempts and metadata
Security Layer
- HTTPS for secure access
- JWT / OAuth2 for authentication and role management
Optional Libraries & APIs
- GeoIP API (MaxMind GeoIP, IPinfo) for mapping IPs to locations
- Email/SMS APIs (Nodemailer, Twilio) for alerts
Working Flow
- Login Attempt Capture
- Each login attempt is logged with username, IP, device, timestamp, and success/failure status.
- Failed Attempt Detection
- Only failed attempts are aggregated for analysis.
- Geolocation Mapping
- Map failed login IPs to physical locations for visual representation.
- Heatmap Generation
- Aggregate failed login counts across time and locations.
- Visualize using interactive heatmaps with hover details.
- Alert & Notification System
- Send real-time alerts for unusual spikes in failed login attempts.
- Dashboard Display
- Provide admins with visual insights, trend analysis, and actionable alerts.
- Reporting & Export
- Export heatmap summaries and detailed logs for audit or security investigation.
Main Modules
- Login Tracker Module → Capture login attempts with metadata
- Failed Attempt Analyzer → Aggregate failed attempts for heatmap generation
- Heatmap Visualization Module → Display interactive heatmaps by time and location
- Geolocation Module → Map IP addresses to physical coordinates
- Alert Module → Notify admin of suspicious spikes or brute-force patterns
- Dashboard Module → Centralized visualization of failed login analytics
- Reporting Module → Export heatmap and failed login data for audit
Security Features
- Secure admin authentication with JWT/OAuth2
- HTTPS-protected portal and API endpoints
- Role-based access control for sensitive analytics
- Real-time alerts for suspicious login activity
- Audit logs with immutable records of login attempts
- IP and geolocation verification to detect potential attack sources