diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md
index 3e9404f..2293f20 100644
--- a/OWASP test - Sloetjes.md	
+++ b/OWASP test - Sloetjes.md	
@@ -9,7 +9,8 @@
 * Describe some logic to monitor failed logins, and using geolocation of the incoming IP address, the permissions of the username trying to log in, and the number of previously failed logins, a procedure to determine whether to alert administrators to a genuine break-in attempt vs a brute-force attempt.
 > * Monitor each login attempt, successful or not.
     > * If a login attempt fails:
-        > Record the IP address, timestamp, and username.
+        
+        > > Record the IP address, timestamp, and username.
         > crease the count of failed attempts for this IP address and/or username.
     > * If there are more than a certain number of failed attempts in a certain timeframe from the same IP or username:
         > Use a geolocation service to identify the location of the IP.