I used to set many passwords with slight variations.
One day I turned on failed login pass capture on a couple of wordpress web sites. I did see some of what I expected, they tried many of the most common passwords,
what surprised me is that they also attempted all kinds of similar variations that included words that our sites might use, but were not in the most common used pass dictionaries.
So they were not just using dictionary and common pass attacks, they were also attempting ones and slight variations of ones that may or may not have included that common things, plus site specific things, then with slight variations.
That was kind of spooky, and had me change up how I set up some things for other people.
One day I turned on failed login pass capture on a couple of wordpress web sites. I did see some of what I expected, they tried many of the most common passwords,
what surprised me is that they also attempted all kinds of similar variations that included words that our sites might use, but were not in the most common used pass dictionaries.
So they were not just using dictionary and common pass attacks, they were also attempting ones and slight variations of ones that may or may not have included that common things, plus site specific things, then with slight variations.
That was kind of spooky, and had me change up how I set up some things for other people.