View page source → fields username and password , failure message "Invalid credentials" .

You have a small passlist.txt (e.g., 100 entries). To avoid detection (account lockout policies), use Hydra's -t (tasks) and -w (wait) flags.

The effectiveness of a Hydra attack is almost entirely dependent on the quality of the passlist.txt . A "deep review" of the attack usually centers on the curation of this list.