I think someone tried to brute force attack my server

[ebr 17021]

25 minutes ago, MRM0NG00SE said:

This seems to point to an Emby Connect breach, that would be the only place I can think of to give this data center a jumping off point.

Hi.  It really doesn't as Connect knows nothing of your user names.

Your machine is constantly being hit by scanners and bots if it is exposed to the internet at all.

[MRM0NG00SE 0]

When configuring users in my server there is a box to literally connect a username on my server to an email address associated with Emby Connect. It wasn’t a red flag until it guessed a username precisely. If the name it guessed was johnsmith or default the bot thing would make more sense, but with the same data center finding my server on a different IP address and a different port and using a specific username that isn’t duplicated anywhere else on this system or any other service that I own makes me consider that where all these data points are available is the point of attack.

[Neminem 1981]

Are any of these options disabled in the user setup?

[MRM0NG00SE 0]

All 3 are enabled for all accounts. Accounts are accessed remotely by Emby Connect, every user is associated to a different Connect account. If a user logs out, the only account they see to log back into should be their own. My server has 3 accounts: mine (administrator) and two others that only access the server remotely.

[ebr 17021]

4 hours ago, MRM0NG00SE said:

When configuring users in my server there is a box to literally connect a username on my server to an email address associated with Emby Connect.

Yes, but that doesn't cause your local user names to ever leave your server in this process.  We use Auth tokens that could not be turned back into one of your local user names.

[MRM0NG00SE 0]

That’s all well and good, but you must be following my logic: the information they used is only available in two places, my server and Emby Connect. They used said info to gain access to my server so it stands to reason that my server wasn’t the source. The two solutions I can see are either they got the information from Connect or they are running AI that correctly guessed that they could access a PMS with username ‘X’ at IP address “Y:Z” (again, my ISP assigns me an IP dynamically so it’s different than the one I had the first time this happened, I’m using non-default ports and the username may as well have been Rhubarb - it’s unique and you’d guess a million other things without a hint) so a data breach is the most likely explanation I’ve come up with so far. The other possibility is terrifying.

[zetetic 5]

Same IP has been trying my server this month. Also this IP: 154.80.128.175

[Kiwi1971 0]

This is still happening on November 5th. Same IP in Buffalo NY. 

It tried users: Test, Vip, jellyfin, TV, NAS, root, guest, 8888888, emby, admin.abc etc

Thankfully, my Users are people's names, not terms.  I thought it just ran the same script and moved on, as it didn't try my first name, which is also part of the server name. But another user said it had guessed a username that wasn't one of the standard ones.  
Now to see if I can change my username without losing my played states.