A user authentication process is initiated by a software application executing on a primary server. The user authentication process prompts a user to enter, via a graphical user interface, login credentials. Thereafter, it is determined that the login credentials have been flagged. The user is then directed from the primary server to a fake server (i.e., a second server) mimicking the software application executing on the primary server. Thereafter, the fake server obtains metadata associated with the user interacting with the fake server that characterizes the user. This obtained metadata can later be provided (e.g., displayed, loaded into memory, stored in physical persistence, transmitted to a remote computing system, etc.). Related apparatus, systems, techniques and articles are also described.