Is this a hacking attempt?

[heffeque 120]

6 hours ago, turpentine said:

 I often use AI to rephrase my English because it’s not my native language. I’m curious to know what was incorrect in what I said.

since i am on ipv6, i have no scans on my ipv6 address.

it is easy to criticize, but what do you propose instead ?

I don't know... it all seems very AI, I can't explain it.

The IPv6 seemed off because people can still find your Emby server through DNS, or through IPv4 (unless you turn off IPv4 and DNS altogether).

I do have an issue though... even though I have a decent symmetric Gbps internet connection, it doesn't have IPv6 available towards the internet (only local net IPv6 that works for matter devices), so... bad start 

But if I did have IPv6, the DNS for the other services would automatically give away my IPv6 address for Emby, since it's all in the same server.

Edited October 22 by heffeque

[jeanlucpicard 24]

12 minutes ago, heffeque said:

I don't know... it all seems very AI, I can't explain it.

The IPv6 seemed off because people can still find your Emby server through DNS, or through IPv4 (unless you turn off IPv4 and DNS altogether).

I do have an issue though... even though I have a decent symmetric Gbps internet connection, it doesn't have IPv6 available towards the internet (only local net IPv6 that works for matter devices), so... bad start 

But if I did have IPv6, the DNS for the other services would automatically give away my IPv6 address for Emby, since it's all in the same server.

every one is paranoid with AIl, you can believe me or not, but i have completely disabled ipv4 everywhere. i eat ipv6, i think ipv6, i sleep ipv6. today when i see ipv4, i see dinosaurs.

i started like everyone in networking. i bought a emby premiere key, and started to put my server online. in the beginning i had no domain name, i used my public ipv4 address directly in the urls. i had no dns record for this ipv4, but in my firewall logs, i was from time to time attacked by some random bots, 2 times or 3 times a day. with ipv4 i was obliged to do nat rules and port forwarding for emby. nat rules does not really botheredd at all. i had no SSL Certificate at that time. i was fed up with firefox or chrome SSL alerts. So what are my free options 

i did not wanted to pay for a SSL certificated

Let's encrypt (free) but you have to change it every 3 month, when you get old you become also lazy, i said wtf, i will go to a system which has to change certificate every 3 month

and alleluia cloudflare certifcate, which have a free certificate until 2036, i said alleluia, these guys are cool. So i put a cloudflare SSL certicate inside my emby server.

houra cloudflare guys are cool, they give me free certificate ! after the cloudflare installation, i had only 2/3 attacks a day on my ipv4 address. at that time, i did nog have choosen a dns entry for my emby server yet. now i used their certificate, i told to myself, they have also a free dns zone. So i went back to my old domain registrar, and i asked the migration to cloudflare dns server.

when my domain name was imported to cloudflare, i added a A record to my domain that goes to public address, and i make a mistake, i let the record in DNS mode. within one hour, i had more than 100 attacks a day to my emby server. i have understood that my ip was flagged to life, and my firewall will be bothered always. my ip was flagged by bots, due to dns entry.

So i asked my provider a new ipv4 address and they were cool they gave it to me. so i said to myself i wont do the same mistake twice. lets try ipv6. more over i was happy, no need to do port forward or nat rules. so i have deleted my SSL certificate, and lets restart everything. when i have activated the ipv6 my nas choose automatically the ipv6 address which is built on my ethernet network card macaddress. i said synology has a very bad implementation of ipv6, so lets change this, within minutes i have changed my ipv6 to a fixed one with random suffix. so my ipv6 was really random. i was too tired to connect again to my cloudflare portal, to make a dns entry, so i wanted to make some tests,  i put the url of my emby server in ipv6  inside my emby client like this http://[2001:0:9d38:6ab8:1c48:3a1c:a95a:b1c]:8096 and it worked well. after several days, i had zero attacks on my ipv6 address.

since i have immediately notice when you add a dns name for a server, withing minutes a bot will try to screw you. i looked the cloudflare docs , and i have noticed the proxy dns record. 

when i added the AAAA record to my ip address, with proxy mode, i put my real ipv6 address, and i made a dns query test, the ipv6 shown was a cloudflare one, not mine. i said to myself these guys are really clever.

then i made a test on linux server with command dig mydomain.org ANY to list all record, and alleluia they was there no AAAA entries or A entries. i said to myself these guys are very very clever. 

a friend of mine wanted emby also, and he did not want to use cloudflare, i have configured everything in ipv6 in a separate virtual machine, and either no attacks. he uses exclusively emby clients with full ipv6 urls with no domain names. i made him 

concerning your setup, if you use already your ipv4 with a lot of services activated, i has been probably already flagged. if you run a web server plus an emby server on the same ipv4 address, you will probably be attacked always.

if you have the possibility to separate the emby service to a unique ipv6 address which is not flagged anywhere. please do it. it is very fun and safe

 

[heffeque 120]

26 minutes ago, turpentine said:

every one is paranoid with AIl, you can believe me or not, but i have completely disabled ipv4 everywhere. i eat ipv6, i think ipv6, i sleep ipv6. today when i see ipv4, i see dinosaurs.

i started like everyone in networking. i bought a emby premiere key, and started to put my server online. in the beginning i had no domain name, i used my public ipv4 address directly in the urls. i had no dns record for this ipv4, but in my firewall logs, i was from time to time attacked by some random bots, 2 times or 3 times a day. with ipv4 i was obliged to do nat rules and port forwarding for emby. nat rules does not really botheredd at all. i had no SSL Certificate at that time. i was fed up with firefox or chrome SSL alerts. So what are my free options 

i did not wanted to pay for a SSL certificated

Let's encrypt (free) but you have to change it every 3 month, when you get old you become also lazy, i said wtf, i will go to a system which has to change certificate every 3 month

and alleluia cloudflare certifcate, which have a free certificate until 2036, i said alleluia, these guys are cool. So i put a cloudflare SSL certicate inside my emby server.

houra cloudflare guys are cool, they give me free certificate ! after the cloudflare installation, i had only 2/3 attacks a day on my ipv4 address. at that time, i did nog have choosen a dns entry for my emby server yet. now i used their certificate, i told to myself, they have also a free dns zone. So i went back to my old domain registrar, and i asked the migration to cloudflare dns server.

when my domain name was imported to cloudflare, i added a A record to my domain that goes to public address, and i make a mistake, i let the record in DNS mode. within one hour, i had more than 100 attacks a day to my emby server. i have understood that my ip was flagged to life, and my firewall will be bothered always. my ip was flagged by bots, due to dns entry.

So i asked my provider a new ipv4 address and they were cool they gave it to me. so i said to myself i wont do the same mistake twice. lets try ipv6. more over i was happy, no need to do port forward or nat rules. so i have deleted my SSL certificate, and lets restart everything. when i have activated the ipv6 my nas choose automatically the ipv6 address which is built on my ethernet network card macaddress. i said synology has a very bad implementation of ipv6, so lets change this, within minutes i have changed my ipv6 to a fixed one with random suffix. so my ipv6 was really random. i was too tired to connect again to my cloudflare portal, to make a dns entry, so i wanted to make some tests,  i put the url of my emby server in ipv6  inside my emby client like this http://[2001:0:9d38:6ab8:1c48:3a1c:a95a:b1c]:8096 and it worked well. after several days, i had zero attacks on my ipv6 address.

since i have immediately notice when you add a dns name for a server, withing minutes a bot will try to screw you. i looked the cloudflare docs , and i have noticed the proxy dns record. 

when i added the AAAA record to my ip address, with proxy mode, i put my real ipv6 address, and i made a dns query test, the ipv6 shown was a cloudflare one, not mine. i said to myself these guys are really clever.

then i made a test on linux server with command dig mydomain.org ANY to list all record, and alleluia they was there no AAAA entries or A entries. i said to myself these guys are very very clever. 

a friend of mine wanted emby also, and he did not want to use cloudflare, i have configured everything in ipv6 in a separate virtual machine, and either no attacks. he uses exclusively emby clients with full ipv6 urls with no domain names. i made him 

concerning your setup, if you use already your ipv4 with a lot of services activated, i has been probably already flagged. if you run a web server plus an emby server on the same ipv4 address, you will probably be attacked always.

if you have the possibility to separate the emby service to a unique ipv6 address which is not flagged anywhere. please do it. it is very fun and safe

 

I think you missed the part where I mentioned that my internet provider doesn't support IPv6...

[jeanlucpicard 24]

13 minutes ago, heffeque said:

I think you missed the part where I mentioned that my internet provider doesn't support IPv6...

my fault, it is really a pity, if you have to possiblity to change one day, do it, it will change your life

[heffeque 120]

10 minutes ago, turpentine said:

my fault, it is really a pity, if you have to possiblity to change one day, do it, it will change your life

I'm not sure it'll change my life, but I'll welcome it with open arms. 

[moviefan 190]

This thread is hilarious.

I changed my port upon initial install.  I have Geoblocking setup.  I've been running Emby since it was MediaBrowser.

I have NEVER had a failed login attempt in my logs from anyone but my actual users fatfingering or forgetting their passwords.

Changing default ports is not "security by obscurity."  It is a real tactic that drastically reduces the people probing that port for a specific service.  I've led security at companies for nearly twenty years and have consulted for over 100 organizations.  I cannot even tell you the amount of times companies have been burned by leaving port 3389 open.  While other companies, still stupidly leaving RDP open to the world, but changing the port, did not have any issue.

I've seen the same at my house.  For a long time I used Cisco or Palo Alto firewalls at my house and had real VPN clients.  In 2020 I switched to Unifi to reduce fan noise, and their VPN kind of sucks.  So I would just open up RDP temporarily if I needed remote access before I switched to Tailscale. Opening it up on another port besides 3389 created no issues.

I've even setup honeypots before to test this exact theory and have done experimentation.  Putting a Windows system with an RDP exploit online on a different port most of the time results in nothing.  On port 3389 it will be exploited within an hour at most.

[Suliamu 57]

1 hour ago, moviefan said:

Changing default ports is not "security by obscurity." 

It is. 
By definition it is exactly that.
And your case is already included in that definition. 
It provides indeed some level of security, -- by using obscurity.
Obscurity means obscuring something. You obscure the service port. 
Got it?
And yes you stop the "white everlasting noise" of stupid bots with East European and Central Asian IPs, but those ancient relics of the past are not the main problem today. 
 

1 hour ago, moviefan said:

I've led security at companies for nearly twenty years and have consulted for over 100 organizations. 

Indeed, as you said: "This thread is hilarious". 
I won't partake in such a nonsensical credentials war in the public but i certainly can say that if this is really true, then, you just were very lucky that nothing bad happened so far... 

And regarding this idea to hide the service behind the mass of ipv6-adresses, - there is plenty of ways of how this IP could somehow leak to a attacker that specifically targets those media servers. 
A malicious addon could do it. 
A malicious other program in your mediaserver-infrastructure could leak it.
A breach of the central licensing server of emby could do it. 
A user of yours leaking this IP in a facebook comment. 
And there is really a lot possible, even the hypothetical scenario that ffmpeg or the custom ffmpeg of emby has somekind of bug that enables to run code that is hidden in a mediacontainer and you download such a file.
Even a data-breach at tvdb or tmdb or whatever could be devastating in such a case. 
And so on and so on, you can really use your fantasy.   

Also i question the practicability of using ipv6-only. 
This might work in certain countries that basically only use ipv6, but adoption of ipv6 is very low in most western countries in general.
If you have multiple users that have different clients at different places, (why would you otherwise open it up in the internet right?) the chance of having a connection that is ipv4 only is very high. Actually most folks i know deactivate ipv6 out of habit in their networks because they fear security implications.
But that is another windmill to fight. 
 

Edited October 23 by Suliamu

[moviefan 190]

46 minutes ago, Suliamu said:

I won't partake in such a nonsensical credentials war in the public but i certainly can say that if this is really true, then, you just were very lucky that nothing bad happened so far... 

I'm so tired of "security experts" telling me that I'm lucky or "It's only a matter of time" until my companies are breached.  There are security measures you can put into place that actually protect companies.  I have helped companies both defend against as well as respond to incidents.  I've eradicated APTs from companies who have been horribly breached.  If your takeaway from my post was that my primary method of security was port obfuscation than I'm not sure what to tell you.  Security has always been about layers.  Port obfuscation for standard services is just another layer.  Whether you want to call that obscurity or whatever I don't care.  It works to block 99% of the bullshit.  There's zero reason not to do it for something like Emby.

Quote

And regarding this idea to hide the service behind the mass of ipv6-adresses, - there is plenty of ways of how this IP could somehow leak to a attacker that specifically targets those media servers. 
A malicious addon could do it. 
A malicious other program in your mediaserver-infrastructure could leak it.
A breach of the central licensing server of emby could do it. 
A user of yours leaking this IP in a facebook comment. 
And there is really a lot possible, even the hypothetical scenario that ffmpeg or the custom ffmpeg of emby has somekind of bug that enables to run code that is hidden in a mediacontainer and you download such a file.
Even a data-breach at tvdb or tmdb or whatever could be devastating in such a case. 
And so on and so on, you can really use your fantasy.   

Also i question the practicability of using ipv6-only. 
This might work in certain countries that basically only use ipv6, but adoption of ipv6 is very low in most western countries in general.
If you have multiple users that have different clients at different places, (why would you otherwise open it up in the internet right?) the chance of having a connection that is ipv4 only is very high. Actually most folks i know deactivate ipv6 out of habit in their networks because they fear security implications.
But that is another windmill to fight. 

I did not promote this IPv6 hiding message, but, again, it's just another layer.  No reason not to do it if it works for you.

[MediaIntelNUC 80]

48 minutes ago, Suliamu said:

But that is another windmill to fight. 

 

 

"Freedom, Sancho, is one of the most precious gifts that heaven has bestowed upon men; no treasures that the earth holds within it or the sea conceals can be compared with it."

Sorry for the OT, but when someone is referencing one of literature:s GOATS i just have to..

/N

 

[jeanlucpicard 24]

12 hours ago, moviefan said:

This thread is hilarious.

I changed my port upon initial install.  I have Geoblocking setup.  I've been running Emby since it was MediaBrowser.

I have NEVER had a failed login attempt in my logs from anyone but my actual users fatfingering or forgetting their passwords.

Changing default ports is not "security by obscurity."  It is a real tactic that drastically reduces the people probing that port for a specific service.  I've led security at companies for nearly twenty years and have consulted for over 100 organizations.  I cannot even tell you the amount of times companies have been burned by leaving port 3389 open.  While other companies, still stupidly leaving RDP open to the world, but changing the port, did not have any issue.

I've seen the same at my house.  For a long time I used Cisco or Palo Alto firewalls at my house and had real VPN clients.  In 2020 I switched to Unifi to reduce fan noise, and their VPN kind of sucks.  So I would just open up RDP temporarily if I needed remote access before I switched to Tailscale. Opening it up on another port besides 3389 created no issues.

I've even setup honeypots before to test this exact theory and have done experimentation.  Putting a Windows system with an RDP exploit online on a different port most of the time results in nothing.  On port 3389 it will be exploited within an hour at most.

i know security expert very well either, i am a router routing network expert since 25 years (layer3). i always tak with them all them along and we are making jokes all day.

they usually see evil everywhere. i am ok with that, but the purpose here is that a user has a flagged ipv4 address. of course changing  the incoming tcp port will help, but the issue is still here. his ipv4 address is still flagged. i see it everydays in arp cache insides routers

in the datacenters, the hackers always know the ipv4 ranges of these datacenters, it is easy for them to scan ipv4 range.

i really hope emby users that have a emby server do not use their emby server to surf over the web. I hope also that emby developpers don't use compromised plugins and so on.

i really hope emby user server use their server only for emby

so every one is right, i would be cool emby developpers could add a feature that blocks over time failed attempts.

the ipv4 address is still flagged.

i just wanted to share my ipv6 experience, with a basic firewall but efficieint that block all incoming tcp connection,  except the emby port. my firewall sleeps.

of course they are a lot of security expert that are afraid of ipv6, but most of the time, it is because they do not know the power of ipv6. hopefully there also security experts that also like ipv6. and we work together to make a better world.

of course when you choose an ipv6 for your emby server, you do not have to think in ipv4 and choose trivial address that a bot can find in 3 seconds

like ::1 ::2 ::100 ::200 ::254, the ipv6 datacenter are well know, they will find you. but e16b:bb32:1b6a:c435 for example is hard to find, if you hide it from dns.

if a user has a flagged ipv4 address, it is very difficult sometimes to ask a new one. in ipv6 they are plenty  340282366920938463463374607431768211456 addresses

you have more chance to get on mars than being bothered   but of course you are right the issue is the human, you do not have stupid things on theirserver, like runing emails programs, where there may be trojan horses.

i wanted to just to help. but if some countries are afraid of ipv6 or some datacenters are afraid of ipv6. users have to stick in the old world

ipv6 is like a drug, when you test it once, you do not want to see anything else . in my country there is ipv6 almost everywhere now.

 

 

 

 

 

 

 

 

Edited October 23 by turpentine

[jeanlucpicard 24]

15 hours ago, Suliamu said:

A malicious addon could do it. 
A malicious other program in your mediaserver-infrastructure could leak it.
A breach of the central licensing server of emby could do it. 
A user of yours leaking this IP in a facebook comment. 
And there is really a lot possible, even the hypothetical scenario that ffmpeg or the custom ffmpeg of emby has somekind of bug that enables to run code that is hidden in a mediacontainer and you download such a file.
Even a data-breach at tvdb or tmdb or whatever could be devastating in such a case. 
And so on and so on, you can really use your fantasy.   

 

in ipv6 hosts can have several ipv6 address, and some are called temporary ipv6 addresses. if the developpers are not ipv4 only minded, they can use the temporary ipv6 addresses to make queries to get some external database risky sites. like this the real ipv6 address that works for the normal emby service is safe. 

most people that criticize ipv6 do not even know how it works

[Neminem 1984]

@turpentine

9 minutes ago, turpentine said:

most people that criticize ipv6 do not even know how it works

Ok, so break it down for us ill advised, teach us, in your own words, not a AI generated  response.

[yocker 2078]

2 minutes ago, Neminem said:

@turpentine

Ok, so break it down for us ill advised, teach us, in your own words, not a AI generated  response.

I'm always ready to learn something new.  

[Neminem 1984]

Lets see if it all smoke

Or if Yoda is up to the task

Ready to listen

[yocker 2078]

8 minutes ago, Neminem said:

Lets see if it all smoke

Or if Yoda is up to the task

Ready to listen

Let's see if the force is strong in this one.

[jeanlucpicard 24]

2 minutes ago, Neminem said:

@turpentine

Ok, so break it down for us ill advised, teach us, in your own words, not a AI generated  response.

I use only AI when my english gets too bad   you can ipv6 training over the web yourself  

[Neminem 1984]

6 minutes ago, turpentine said:

I use only AI when my english gets too bad   you can ipv6 training over the web yourself  

 

7 minutes ago, yocker said:

Let's see if the force is strong in this one.

It not was

[jeanlucpicard 24]

1 hour ago, Neminem said:

It not was

if you think, it will work on me  an ipv6 training is very long from scratch. talking about ipv6 is not enough, you have also to talk about routing.

my purpose was not really to do a training in here, but to  encourage people to use it as soon as they can, of course if they like technical things. a sort of teasing

ipv6 is magical. for those you know ipv4 well, there are new concepts in ipv6 like pemanent addresses which can be based on the mac address of your network card, or using a random generated fixed ipv6 address. and there is also privacy extensions, with new cryptographic addresses than can be used for doing risky things. they usually change every 24 hours,

i will not do a complete training because you are provoking me

if users has no access to ipv6. SanguineWren has to try change the incoming port, or wait the emby team to add new feature that may blocks brut force attacks. when an ipv4 is flagged, bots will let his ip inside their malefic hacking database.

Edited October 23 by turpentine

[MediaIntelNUC 80]

1 hour ago, turpentine said:

can be used for doing risky things.

[ginjaninja 667]

On 22/10/2026 at 00:07, BalthazarBux said:

I also got exactly that, from data center in US. Still a bit weird, have our logs some info in them maybe, if we have posted them here sometime?

was it 107.172.0.0/14 out of interest? i havent seen attacks in years then got one the other day on this range.

[BalthazarBux 19]

11 minutes ago, ginjaninja said:

was it 107.172.0.0/14 out of interest? i havent seen attacks in years then got one the other day on this range.

107.175.140.110

[ginjaninja 667]

4 minutes ago, BalthazarBux said:

107.175.140.110

snap

[jeanlucpicard 24]

2 hours ago, MediaIntelNUC said:

what i wanted to say, is even if your temporary ipv6 is collected anywhere with a compromised web site, it does not really matter, as it change every day  don't be afraid

[TMCsw 317]

This has become a “My dad can beat up your dad” thread.

Let's be more realistic, please. This is Emby, not the Bank of America...

…People who try to hack a personal server are not going to spend much time trying to get around some of the simpler measures (TLS/ssl, reverse proxies, unusual port#, etc.).

And yes, I do think IPv6 is much better for many reasons (no NAT/CGNAT/Hairpin…), but many people still seem to want an IP# address they can memorize (old dial-up users/gamers). I block raw IPv4 access.

But more importantly, most Emby home admins/users do not have the time, skills, or even the knowledge that opening a port carries a risk (or that UPnP did it for them) or that allowing a VPN (Tailscale/Meshnet/etc.) to access your server carries a risk.

We should be making suggestions for simpler ways to help the Brain Sergins/Rocket Scientists/Average Dude/Dudette, who have trouble understanding how to secure their Emby server…

…So perhaps these advanced “precautions” would be better discussed in the Non-Emby forum .

[jeanlucpicard 24]

11 hours ago, TMCsw said:

This has become a “My dad can beat up your dad” thread.

Let's be more realistic, please. This is Emby, not the Bank of America...

…People who try to hack a personal server are not going to spend much time trying to get around some of the simpler measures (TLS/ssl, reverse proxies, unusual port#, etc.).

And yes, I do think IPv6 is much better for many reasons (no NAT/CGNAT/Hairpin…), but many people still seem to want an IP# address they can memorize (old dial-up users/gamers). I block raw IPv4 access.

But more importantly, most Emby home admins/users do not have the time, skills, or even the knowledge that opening a port carries a risk (or that UPnP did it for them) or that allowing a VPN (Tailscale/Meshnet/etc.) to access your server carries a risk.

We should be making suggestions for simpler ways to help the Brain Sergins/Rocket Scientists/Average Dude/Dudette, who have trouble understanding how to secure their Emby server…

…So perhaps these advanced “precautions” would be better discussed in the Non-Emby forum .

i agree with you  

https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption

this is quite funny. the bank of america is not the first :)