11. A method comprising: receiving, by a server, a credential from a user during an authentication process; determining, by the server, the received credential is not correct; comparing, by the server, the received credential to a list of common credentials; and when the received credential matches a common credential on the list of common credentials: increasing, by the server, a score by a weighted factor based on the received credential matching the common credential, wherein increasing the score indicates an increased likelihood that an attacker is attempting to gain unauthorized access to a user account; storing a time associated with the score increase; and making a security determination, by the server, based on the score. wherein the weighted factor is lower when a time since a previous score increase is greater than a threshold time than when the time since the previous score increase is less than or equal to the threshold time.
17. The method of claim 11 , wherein increasing a score comprises increasing a score associated with a user authentication attempt.