Credential-probing is the repeated testing of usernames, passwords, or account access to find valid credentials. Attackers may automate login attempts against web portals, VPNs, SSH, email, APIs, or admin panels, using guessed passwords, leaked credential lists, or password-spraying methods. The goal is usually to identify weak, reused, or exposed accounts rather than to break encryption or exploit code directly.
This matters because successful probing can lead to account takeover, privilege escalation, and lateral movement without triggering a traditional exploit. In real attacks, it often appears as many failed logins from one or more IPs, attempts against multiple accounts, unusual geographic sources, or repeated requests to authentication endpoints. Defenses include multifactor authentication, strong password policies, rate limiting, lockouts, IP reputation controls, and log review for abnormal login patterns. Detecting credential-probing early can stop an intrusion before it becomes persistence or command-and-control activity.