FTP Security — Brute Force on Serv-U, and the Sources that Keep Hammering Through Its Own Ban

The FTP server bans a source after a burst of failures; a real attacker simply keeps retrying through the ban. RoutePulse reads the server’s authentication log through the SIEM, counts failures and retries during the product’s own ban, and turns the most aggressive profile — hammering — into a core-router blackhole with a punitive TTL, while a login whitelist protects every account that authenticated successfully in the last 30 days.

The page shows every source with its attempts, usernames, protocols, reverse DNS, whether it is a known scanner, the product’s ban state and RoutePulse’s own response; thresholds are live knobs and every blackhole is reversible from the Mitigations page.

Back to RoutePulse Overview