FortiGate SSL VPN login via generic admin accounts on alt HTTPS ports

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•5

Detects login attempts to internet-exposed FortiGate SSL VPN or firewall management interfaces using suspicious, generic, or potentially leaked administrative account patterns such as fgt-*, FortiManager-*, or tech-support-*. These accounts typically suggest attempts to exploit default, hardcoded, or publicly shared credentials on network infrastructure.