A common mistake of early FTP administrators was to permit a directory named /incoming that allows full read and write access by external users, but the files themselves in /incoming were hidden; by creating a directory inside /incoming, this hidden directory would then allow normal file viewing. Users of the compromised site would be directed to log in and go to a location such as /incoming/data/warez to find the warez content. Messages could be left for other warez users by uploading a plain text file with the message inside.