I think someone tried to brute force attack my server

[Mrm0ng005e 2]

Hi there all! I've been using Emby for a little over a year so I'm fairly familiar with the Dashboard. When I just pulled it up I was greeted by four red alerts about failed login attempts from users that don't exist on my server. Generic names like 123456, root and nas. When I clicked on alerts to see the expanded list, there were 23 attempts. All of them were logged in the same minute (10/14/26, 1:06 PM) from the same IP address (107.175.140.110, which pings out of Buffalo, NY) and when I compare this to listed activity the last time I used the server was 13 hours before and I didn't authenticate again until 12 minutes after the "attack'. I'm wondering if anyone has any ideas how something like this could happen and how I might defend against it in the future?

[TMCsw 317]

Yes, Emby has some rudimentary protection, but there are many more ways to protect yourself:

• use ssl  (TLS)
• a reverse proxy with..

TLS

GEOp-Blocking

This has been discussed many times before ... search...

[Luke 43537]

How it happens is people out there are using port scanners looking for any kind of server with public services exposed that it can tap into. 
 

one other thing that can help make your server harder to find is to use a non default router port number.

[RGX 1]

Not just you, I happened to find this thread and the same exact IP (107.175.140.110) tried to brute force into my server too. It happened on 10/14/26 1:09pm as well. I figured I'd chime in.

Edited October 17 by RGX

[Mrm0ng005e 2]

Huh, no kidding... I've been running personal media servers on the default settings for two decades now and never run into anything like this. Granted I've never used default user names and passwords for fear of this scenario its hard to fathom what the upside of gaining access to a pms on decade old mailbox system in the middle of Maine could possibly be. I'll make an effort to change my port settings so this doesn't happen again in the future, thanks for your assistance!

[Luke 43537]

Please let us know how things go. Thanks.

[Azoroth87 0]

Same thing happened to me. It's happened the last 3 days actually. All from the same IP address. 

[Patdep 0]

Same thing here, back from vacation and I have the same alerts every day since October 14.

[Evol2011 0]

I had the same thing on sunday from the same IP and I have been seeing stories that Plex servers across the country were attacked by crypto miners over the weekend by 4 distinct IP addresses, different from this one but consistant across all of the plex accounts. 

[Neminem 1981]

On 10/16/2026 at 2:50 AM, TMCsw said:

Yes, Emby has some rudimentary protection, but there are many more ways to protect yourself:

• use ssl  (TLS)
• a reverse proxy with..

TLS

GEOp-Blocking

This has been discussed many times before ... search...

I will agree with this.

But also change your public facing port to something not default.

Port 8096 is used by both Emby and Jellyfin.

Change it to some obscure port if you are not using a reverse proxy with security in place.

[Uncle_Frank 18]

On 10/16/2026 at 12:16 AM, Luke said:

How it happens is people out there are using port scanners looking for any kind of server with public services exposed that it can tap into. 
 

one other thing that can help make your server harder to find is to use a non default router port number.

Yeah it doesn't usually mean they are targeting emby they are just targeting anything that has an open port usually from a vps setup to scan 24 hours a day especially people using ai for the purpose of bad intentions.

That ip address is a data center go figure, tax payers money gone to network attacks 

 

Edited October 20 by Uncle_Frank

[Mopar 1]

any updates on this? just seen the same for me, same dates and times as well.. googling the ip address actually brought me to this thread

 

[Luke 43537]

25 minutes ago, Mopar said:

any updates on this? just seen the same for me, same dates and times as well.. googling the ip address actually brought me to this thread

 

Hi, have you taken some of the steps suggested in here?

[MRM0NG00SE 0]

As suggested I changed the default open ports (8080 and 8096) and forwarded them in my router. Since then I’ve had no issues, but as mentioned above I’ve been running media servers since the aughts on default ports with no issues. I’m not sure about the security settings TMCsw was referring to, seems like he intended that post to be more snarky than helpful.

[Acceptance 0]

I don't know if it's helpful but I also had about 20 failed login attempts from that same IP all at exactly 10/25/26, 12:08 AM. I use a reverse proxy and have IP banned that address with fail2ban/nginx. 

[Sketchcatt 0]

I was also bombarted with failed login attempts on October 14, at 10:07 pt.

[Sketchcatt 0]

I have a queston about all of this...what would anyone do if they were able to login to your emby? If they didn't have the permisssons of the admin, wouldn't it be harmless? what would they be able to do really? 

[nonyhaha 4]

Hello. 

I am in the same situation. The thing is, I have already been using a reverse proxy with ssl for many years, so I am really curious how they got to my server, as it is not usinge something like emby.mydomain.com. 

Very very interesting. 

Locked that ip out now. Will keep an eye on it. 

[Neminem 1981]

If I where to scan the internet for open Emby server's.

I would not scan for dns names, but would scan ip ranges. 

[nonyhaha 4]

That would not affect reverse proxies using wildcards. My only open ports are 80 and 443.

[Neminem 1981]

I guess that would mean, your dns name is known by bad actors.

If they hit that specific dns name.

[GHynson 10]

It looks like an AI agent doing this from a Data Centre.

Not even Russian Noobs can hammer my site with a couple 1000 hits within a sec.

There are several ways you can block this from hitting your emby server directly.
1) Block the IP directly from your Router this will prevent the traffic from getting to your server.
     In my case,  I didn't block the IP range, I set my Router to forward the traffic back to 107.175.140.110.
2) Add the IP scope range in your block list in Windows firewall, if your on Windows. 
     I host my servers on Windows Server 2025, and the built in firewall works very well blocking entire Domain ranges.
3) Use the Nuclear option and contact your ISP.
    In my case, I can contact AT&T and report the abuse, and they can block the traffic on their end. And maybe even take legal action against that Datacentre.
 

[KrispyKrinkle 0]

I got the same thing.

I did report it to the data center. not sure if it will go anywhere.

[Mariusz 3]

Me too....

I’ve seen failed login attempts from the same IP, 107.175.140.110. On October 30, my Emby logs recorded eight attempts using generic usernames such as test, root, guest, and vip. All eight were rejected with HTTP 401.

I blocked the address using a persistent Windows Firewall inbound rule, restricted to Emby’s TCP listening port and enabled for all firewall profiles. I verified that the rule was active and Emby remained accessible. No server restart was required.

Although I use Cloudflare for my domain, these requests appeared to reach my server directly. The Host header contained the server’s IP address and port rather than my domain, and there were no Cloudflare proxy headers. That is why I applied the block on the server itself.

The logs cannot tell me how the address was discovered. Automated port scanning is one possibility, as Emby staff mentioned earlier in this thread. Other possibilities include historical DNS records or another DNS-only record exposing the same server IP. Cloudflare describes those risks in its origin protection documentation.

Using Cloudflare for a domain does not automatically prevent direct access to a publicly reachable origin server. This firewall rule blocks the specific IP reported here; it is not automatic protection against attempts from other addresses.

Edited October 30 by Mariusz

[MRM0NG00SE 0]

After previously changing the default ports as suggested, things were fine until today when the same IP address attempted connecting again. It tried a variety of default names again like root and abc but this time it guessed a valid username and gained access. They authenticated on an iPhone and did nothing, then 16 minutes later they authenticated on an iPad and did nothing. I added the IP address to the Emby blacklist (my TP Link router doesn’t support blocking external connections without a subscription) so hopefully this will end the saga but it adds intrigue because they guessed a username, and it’s not like they went through a dictionary. The last few attempts are jellyfin, root, 123456 and <ACTUAL USER NAME>. Now I’m wondering where they came up with that in addition to the address to my server. As mentioned the default ports aren’t opened anymore so it doesn’t seem like a port sniffing issue and my external IP address has changed so my system shouldn’t be in a database of failed access attempts. This seems to point to an Emby Connect breach, that would be the only place I can think of to give this data center a jumping off point.