Login Attempt Status Codes

Below is the list of status codes one might see in a report, along with the associated explanation of each code.

attempts: This IP tried too many incorrect user/pass combinations. May be a brute force or dictionary attack. IP suspended.

avs45err: The AVS server returned a 400 or 500 class error.

badchars: The user/pass contained an invalid character, like a null or backtick.

badexpir: Expired. User was created in Strongbox admin and expiration has passed.

badimage: Wrong turing word (enter the secret word show in the image...)

badpuser: No such username exists.

badpword: Wrong password.

badrefer: The person came from a site like easypasswords.com or ultrapasswords.com with the word "pass" or "hack" in the name.

baduname (deprecated): No such username exists.

badcntry: Country manually banned in config.pl.

dis_uniq: Way too many IP ranges using this username. It's probably on a password site. Username disabled permanently.

dis_cnty: People from too many countries using this username. Username permanently disabled.

dis_spdr: The Proactive Spider found this user name on a password site. Username disabled until it is manually re-enabled by the webmaster.

emptyUrP: Username or password field left empty.

goodhndf: Successful handoff from another site.

goodpage: Successful login.

gooduser: Successful login.

htpffail: Couldn't open .htpasswd. Also generalized to MySQL or other data stores to mean the user/pass lookup could not be performed.

logffail: Couldn't open the log file. If this code shows up in the log, something went very wrong.

manipblk: This IP Address has been manually suspended by a Strongbox Admin user through Strongbox Member Management console.

opnproxy: Access from open proxy. Access was allowed, but Strongbox is watching this IP carefully.

shrthead: Invalid HTTP request sent by browser, usually either the result of badly configured anonymous / privacy software or a poorly written cracking program, "personal privacy", "anonymizer", or "firewall" software will only do this when the settings are jacked up to super maximum. Typically software that can do this will be marketed to "prevent web sites from dentifying you", so I might tell a member that the software did exactly what it claimed - it prevented us from identifying them as a legitimate member. If it's actually a live user, the user will likely have problems with many sites and should set their "firewall" software to it's default settings or turn it off entirely.

totllgns: Just too darn many logins recently with this username, possibly all from the same IP.

uniqcnty: People from too many countries using this username. It may be on a password site. Username suspended.

uniqisps: People from too many different ISPs using this username. It may be on a password site. Username suspended.

uniqsubs: Too many IP ranges using this username. It may be on a password site. Username suspended.