FTP Brute Force - Repeated 530 Login Incorrect Responses

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects multiple FTP login failures ('530 Login incorrect') from a single source IP address within a short time window, indicating a potential brute force or password guessing attempt against an FTP service.