Looking at the "User Agent" often reveals tools like Hydra or Python-requests , indicating an automated attack.
Usually identified as the source IP that appears most frequently or at odd hours.
Repeated failed login attempts followed by a single successful one.