This question concerns dictionary attacks conducted:
- Over the Internet, using programs like THC Hydra
- Via protocols such as HTTP, FTP and SMTP
I believe I'm right in thinking that: a) due to the sophisticated layers of security they tend to employ, such an attack cannot be run successfully on the bigger sites (Facebook, Twitter, Gmail, Outlook and so on) without needing to mask your IP, channel the attack through the Tor network and distribute it among an army of botnets; b) that the efficacy of these attacks on smaller self-hosted sites is limited only by the competency of the person(s) running their servers.
However, what about the gap that occupies the (arguably) larger space in between the two - the medium-to-small web hosting providers that the rest of the web relies on for uptime.
On average, is the security of these organisations generally advanced enough to detect a guessing attack from a single IP address and permanently ban the address over those protocols? Is anonymising yourself during an attack on such a target just as much of a necessity as it would be when targeting the big sites?
Or to put what I'm asking another way: has the security of the smaller web hosting organisations now become sufficiently advanced enough so as to make guessing attacks from a single machine, without anonymisation, entirely obsolete?
I ask this because none of the write-ups I've seen on the topic (guides to the use of THC Hydra and similar programs for both dictionary and brute-force attack) so much as mention either anonymisation or the distribution of attacks with bots, and it's left me wondering just how necessary or unnecessary such steps are when doing so.
Are there hackers that are actually getting anywhere without taking those measures?