FTP Check
1. INFO
In this article, we’ll dive deep into FTP connections and how to work with them in practice. FTP (File Transfer Protocol) remains one of the oldest and still widely used protocols for transferring files between a client and a server. It is the default method most website owners, developers, and admins use to upload sites, update content, deploy backups, or manage files directly on hosting servers.
However, FTP has a major weakness that has not changed in decades: it is extremely vulnerable to brute-force attacks, credential stuffing, and password-spraying campaigns. The reasons are simple:
- Many budget and mid-tier hosting providers still offer plain (unencrypted) FTP on port 21 by default;
- A huge number of users continue to choose weak or default passwords (admin/admin, ftp/123456, user/password, etc.);
- Credentials are sent in clear text — anyone who can sniff the traffic immediately sees the login and password;
- Billions of stolen credential pairs (email:pass, login:pass) from infostealers, breaches, and combo lists are still actively circulating and being tested in 2026.
Because of these factors, attacking FTP remains one of the easiest, cheapest, and most profitable types of automated access hunting. A single valid login can give full control over websites, hosting accounts, databases, emails, API keys — sometimes dozens of projects at once.
HOW TO
To get started you need a solid database of potential FTP credentials. These lists are usually built from:
- Logs leaked by infostealers (RedLine, LummaC2, Vidar, Raccoon, etc.);
- Public and private combo lists;
- Forum dumps, Telegram channels, dark web markets;
- Cross-referenced results from previous SMTP, cPanel, DirectAdmin, SSH, or webmail checks.
Our software provides two main functions for preparing FTP lists:
- 24) Get FTP/SSH/SFTP
- 4) Get FTP Result
Once the list is compiled, the next mandatory step is validity checking. Use function 50) FTP Check for this.
Workflow:
- Load your prepared database
- Start the checker and wait for completion.
The checker will produce a clean results file containing only live, working accounts. Each valid line typically includes:
- IP address / domain / port;
- Login and password;
- Connection type (plain FTP, explicit FTPS, implicit FTPS);
- Directory listing of the root folder (usually /public_html, /www, /httpdocs, /domains/domain.com/public_html, etc.);
- Often: disk usage info, presence of interesting files (wp-config.php, .env, configuration.php, backup.sql, users.db, index.php with known CMS fingerprints, etc.).
What are these databases used for?
Valid FTP accounts remain one of the most versatile and high-value assets in 2026. Here are the most common real-world use cases:
- Malware hosting & distribution — legitimate hosting space triggers far fewer AV/ sandbox detections; traffic blends in with normal site activity;
- Cryptojacking / hidden JS miners — injecting Coinhive-style or WebAssembly miners into high-traffic legitimate sites;
- Traffic redirection — fast 301/302 redirects or JavaScript-based redirects to CPA offers, gambling, nutra, adult, survey scams, crypto drains, etc.;
- Database & credential harvesting — downloading full user databases (*.sql, *.db, *.sqlite), configuration files with API keys, SMTP credentials, admin panel passwords, email account logins;
- Phishing kit deployment — replacing index.html / index.php with clones of banking, crypto exchange, PayPal, Gmail, Office 365 login pages;
- Long-term persistence & backdooring — installing webshells, file uploaders, reverse shells, or ransomware encryptors for future use or resale;
- Account reselling — cleaned & verified FTPs with good hosting / traffic are sold in bulk or as “aged” access on underground markets.
A single good FTP on shared/business hosting with decent traffic and low owner activity can stay profitable for months — especially if the legitimate user rarely logs into the control panel and doesn’t notice small changes.
Pro tip: always use residential proxies / socks5, avoid aggressive mass downloads, don’t touch obviously monitored files, and never leave clear-text notes or obvious backdoors. Stay low-profile.
Good hunting.