Russian ftp hack attempts on test username

Portal Home > Knowledgebase > Articles Database > Russian ftp hack attempts on test username

Posted by ursa-musculus, 03-18-2014, 02:30 PM
Has anyone else noticed a big uptick of attempted ftp logins using the username "test", coming from IPs associated with mainly Russia and Ukraine, but also a few from Belarus?
Posted by HostingBig, 03-18-2014, 02:35 PM
Hacking attempts from everywhere are up several 100% since the beginning of the year, and Yes have 85 attempts across 2 servers in the last 3 days most of them today
Posted by AppDevPoint, 03-18-2014, 02:40 PM
I read this and I was thinking why trying to hack a test user. The chances are very small for a test username to exist on production servers used for web hosting.
Posted by ursa-musculus, 03-18-2014, 02:46 PM
Historically, ftp hack attempts have used a domain name hosted on the server as the ftp username. It's just been in the past 48-72 hours that I've seen loads attempting on "test", all from those geographical locations.
Posted by helix247, 03-18-2014, 02:46 PM
Probably trying to find a user leftover from server setup. For servers that are setup poorly, they could potentially upload something which would grant them access to different parts of the server.
Posted by Microlinux, 03-18-2014, 04:48 PM
Why try to hack anything? Cracking is numbers game using automation. If a 'test' account is found, one could reason it may be less likely to be properly secured.
Posted by CircuitoX, 03-18-2014, 08:30 PM
I received hack attempt from pakistan, but was not successful.
Posted by vB-WP-Admin, 03-18-2014, 11:30 PM
Maybe a new malware is out, which creates test user?
Posted by kpmedia, 03-19-2014, 03:55 AM
FTP hack attempts are a nuisance this year. I moved my FTP port, and that removed 99% of it.
Posted by hostingvince, 03-21-2014, 09:36 PM
Yep, same here. Getting approx 20 email alerts per hour since last 2 weeks, attempts are for both ftp and smtp

Add to Favourites Print this Article