I think someone tried to brute force attack my server

[Mrm0ng005e 0]

Hi there all! I've been using Emby for a little over a year so I'm fairly familiar with the Dashboard. When I just pulled it up I was greeted by four red alerts about failed login attempts from users that don't exist on my server. Generic names like 123456, root and nas. When I clicked on alerts to see the expanded list, there were 23 attempts. All of them were logged in the same minute (10/14/26, 1:06 PM) from the same IP address (107.175.140.110, which pings out of Buffalo, NY) and when I compare this to listed activity the last time I used the server was 13 hours before and I didn't authenticate again until 12 minutes after the "attack'. I'm wondering if anyone has any ideas how something like this could happen and how I might defend against it in the future?

[TMCsw 305]

Yes, Emby has some rudimentary protection, but there are many more ways to protect yourself:

• use ssl  (TLS)
• a reverse proxy with..

TLS

GEOp-Blocking

This has been discussed many times before ... search...

[Luke 43336]

How it happens is people out there are using port scanners looking for any kind of server with public services exposed that it can tap into. 
 

one other thing that can help make your server harder to find is to use a non default router port number.