Is this a hacking attempt?

[ZanderKeen 88]

We had this hit our server too with same IPs and usernames.

Here's what we did on Fedora (firewalld) to ban the IP range:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="107.175.140.0/24" drop'
sudo firewall-cmd --reload

I also reported that IP on ipthreat.net & we are using this incident to audit our fail2ban configs.

Just passing this info along for others that may find it useful. 

Thanks

[ginjaninja 667]

i wonder what an attacker could do if they could log on. is emby widely enough investigated to know if there are vulnerabilities that could lead to compromise of the system. i doubt the attacker just wanted to play some media.

[rbjtech 5404]

On 24/10/2026 at 01:24, TMCsw said:

This has become a “My dad can beat up your dad” thread.

Let's be more realistic, please. This is Emby, not the Bank of America...

…People who try to hack a personal server are not going to spend much time trying to get around some of the simpler measures (TLS/ssl, reverse proxies, unusual port#, etc.).

And yes, I do think IPv6 is much better for many reasons (no NAT/CGNAT/Hairpin…), but many people still seem to want an IP# address they can memorize (old dial-up users/gamers). I block raw IPv4 access.

But more importantly, most Emby home admins/users do not have the time, skills, or even the knowledge that opening a port carries a risk (or that UPnP did it for them) or that allowing a VPN (Tailscale/Meshnet/etc.) to access your server carries a risk.

We should be making suggestions for simpler ways to help the Brain Sergins/Rocket Scientists/Average Dude/Dudette, who have trouble understanding how to secure their Emby server…

…So perhaps these advanced “precautions” would be better discussed in the Non-Emby forum .

It could be debated why Emby is alerting you at all to this failed login attempt.   If this is not a valid account, then it doesn't actually matter, because it will never work - there is no account, there is no password.   So drop it - log it as a drop by all means, but don't alert the user.   The only logs/alerts that should appear is on valid accounts with the incorrect password - and they will lock out after 10 repeat attempts anyway.    

[heffeque 120]

15 minutes ago, rbjtech said:

It could be debated why Emby is alerting you at all to this failed login attempt.   If this is not a valid account, then it doesn't actually matter, because it will never work - there is no account, there is no password.   So drop it - log it as a drop by all means, but don't alert the user.   The only logs/alerts that should appear is on valid accounts with the incorrect password - and they will lock out after 10 repeat attempts anyway.    

No. I'd rather be notified when someone tries to access my system.

Why would I not want to be notified of an unwanted person trying to access my system? 

[pwhodges 2132]

Because you would have continuous notifications.  The accesses to your Emby are sure to be a small part of what is hitting your router all the time, and if they're failing they are of no greater concern than the rest.

Paul

[heffeque 120]

22 minutes ago, pwhodges said:

Because you would have continuous notifications.  The accesses to your Emby are sure to be a small part of what is hitting your router all the time, and if they're failing they are of no greater concern than the rest.

Paul

I don't have Emby installed in my router, and I'm pretty sure that's the case for most people.

Not trying to sound offensive, but I prefer to be informed of hacking attempts so that I can have more information to decide what measures I want to take; and not someone else decide for me.

One of my users might have a changed their password to a weak password; and if the bot enters, I might not know about it because the login was successful. If I'm not aware of previous unsuccessful events, I won't be able to notice anything strange. 

Information is power. 

Edited October 28 by heffeque

[rbjtech 5404]

2 hours ago, heffeque said:

I don't have Emby installed in my router, and I'm pretty sure that's the case for most people.

Not trying to sound offensive, but I prefer to be informed of hacking attempts so that I can have more information to decide what measures I want to take; and not someone else decide for me.

One of my users might have a changed their password to a weak password; and if the bot enters, I might not know about it because the login was successful. If I'm not aware of previous unsuccessful events, I won't be able to notice anything strange. 

Information is power. 

Nobody is 'hacking' you - if you looked at your router you will find 10/100/1000's of 'attempts' daily using your public IP address to get into your system.   They will all be dropped by your firewall (and likely unlogged) and those that get a 'hit' to a system answering a probe (because you have that port 'open'), should not alert you to the attempt if they do not know your username as at this point, they are not a threat.    If they try a valid account, THEN I agree 100% you should be alerted/informed.

Targeted Information is useful - overload of useless information is just noise that distracts you from the real threats.

The Emby change needed here is to default alerts for unknown accounts to off.  Log them, but an Info level only imo.

Edited October 28 by rbjtech

[heffeque 120]

16 minutes ago, rbjtech said:

Nobody is 'hacking' you

That's the idea: that I avoid the hacking attempts. 

They've tried valid account names. 

[rbjtech 5404]

1 minute ago, heffeque said:

They've tried valid account names. 

If you have common accounts such as guest or root available on any internet facing system - then I would suggest removing them - you are inviting a 'probe' into a more targeted attempt.  

[heffeque 120]

9 minutes ago, rbjtech said:

If you have common accounts such as guest or root available on any internet facing system - then I would suggest removing them - you are inviting a 'probe' into a more targeted attempt.  

It was accounts that didn't have the "hide this user from login screens on devices they've never been signed into".

I've obviously changed that on all users now. 

Edited October 28 by heffeque

[js28194 76]

On 10/28/2026 at 8:33 AM, heffeque said:

That's the idea: that I avoid the hacking attempts. 

They've tried valid account names. 

Avoid?  Your not going to be able to "Avoid" anything.  You can ban their IP and THEY will move on to another IP and try again.  Unless you block the entire internet all together.  Thank Jebus, I don't get alerts.  I think even Microsoft killed alerts that occur in the eventlog for bad log in attempts.  They did that a long time ago.  Can you imagine what this would look like if I got alerts on every thing?

 

[js28194 76]

Also, can't you do notfications already via webhooks or something?

I thought was a built in thing for people to use.

[crusher11 1359]

9 minutes ago, js28194 said:

Avoid?  Your not going to be able to "Avoid" anything.  You can ban their IP and THEY will move on to another IP and try again.

 

I've had a couple of instances of someone trying a bunch of different credentials on my Emby server, and blocking their IP got rid of them.

[js28194 76]

Just now, crusher11 said:

I've had a couple of instances of someone trying a bunch of different credentials on my Emby server, and blocking their IP got rid of them.

Yup, that is the best you are going to be able to do.  It's a fruitless endavor to try to solve from every iteration of every attempt.  You can put in the advance mitigations such as reverse proxy, cloud fare tunnels and some of those techniques can be extremely helpful.  You don't want to be the low hanging fruit at the end of the day.

[heffeque 120]

13 minutes ago, js28194 said:

Avoid?  Your not going to be able to "Avoid" anything.  You can ban their IP and THEY will move on to another IP and try again.  Unless you block the entire internet all together.  Thank Jebus, I don't get alerts.  I think even Microsoft killed alerts that occur in the eventlog for bad log in attempts.  They did that a long time ago.  Can you imagine what this would look like if I got alerts on every thing?

 

Let me choose if I want those alerts. Don't choose for me. 

[crusher11 1359]

2 minutes ago, js28194 said:

Yup, that is the best you are going to be able to do.

Successfully getting rid of them, trivially, doing the very thing you said wouldn't work? I mean, I'll take it!

[js28194 76]

Just now, crusher11 said:

Successfully getting rid of them, trivially, doing the very thing you said wouldn't work? I mean, I'll take it!

What am I saying is that they can move on to attempt from a different IP address which you will then have to block again.  Now, I"m saying that they will do that, but you and I have no control over what they will or won't do.  If I knew that, I'd play the lotto every day.

 

@heffequeThere is a notification section in the admin page.  Learn it and use it.

[js28194 76]

Also, what am I missing here?  There seems to be a crap ton of plugins for notifications.  I'm not going to install a single one of them.  Seems to be plethora of choices.  And after looking at this section more closely, it appears I have the webhooks plugin installed.  I'm getting rid of it.  Don't need it nor want it.  Take a look and you may find something that fits your needs.

 

Edited October 29 by js28194

[heffeque 120]

13 minutes ago, js28194 said:

There is a notification section in the admin page.  Learn it and use it.

I know it, and you know I know it. What are you trying to achieve writing that? 

You're the one advocating for the notification to be removed. 

[js28194 76]

I'm not advocating for it to be removed.  I don't know what people are asking for.  This thread has become convoluted and is now boring me.  

I move on.

[heffeque 120]

5 minutes ago, js28194 said:

I'm not advocating for it to be removed.  I don't know what people are asking for.  This thread has become convoluted and is now boring me.  

I move on.

Woops! Sorry about that. I got you mixed up with rbjtech.

My bad.

[moviefan 190]

Do not disable failed login notifications please.  If people want to switch them off, give them a toggle.

I do not get any alerts, and I want to know if someone is trying to brute force me.  In fact, I have my logging for Emby triggering automatic IP bans if it happens too much, and this has never been triggered.

[jeanlucpicard 24]

On 10/29/2026 at 3:30 PM, js28194 said:

I'm not advocating for it to be removed.  I don't know what people are asking for.  This thread has become convoluted and is now boring me.  

I move on.

i do not think it is a good idea to be removed, i would prefer it to be closed.

fighting bots is useless, they already know their ip. the only hope is to hide.

when people will understand, that your own public ip address is marked, by bots, the debate can be infinite. all the ipv4 datacenters in the world have bots. even if you block a bot, bots exchange their marked easy target ip databases. if you block one, another bot will do the job.

unless the person change their ipv4 public address by changing datacenter providers or home internet routers providers, (ipv6 is still the best)

 

 

Edited October 31 by turpentine

[js28194 76]

11 hours ago, turpentine said:

i do not think it is a good idea to be removed, i would prefer it to be closed.

fighting bots is useless, they already know their ip. the only hope is to hide.

when people will understand, that your own public ip address is marked, by bots, the debate can be infinite. all the ipv4 datacenters in the world have bots. even if you block a bot, bots exchange their marked easy target ip databases. if you block one, another bot will do the job.

unless the person change their ipv4 public address by changing datacenter providers or home internet routers providers, (ipv6 is still the best)

 

 

Agreed. OP needs to implement better mitigations i.e. reverse proxy ssl, cloudfare whatevers, ipv6 and move on.  If you have simple port forward, these types of issues SHOULD be expected.  My brain is again hurting and now I'm really moving on from this thread.   Yes OP, YES.  People (He/They/She/Him/BOT/SBOT) have scanned your IP and know you have PORT forward (Since they got a response) and throwing the kitchen sink at you.  Chalk up a WIN to YOU since those accounts don't exist on your EMBY SERVER so EMBY worked as intended.  I'm shocked I didn't see a SYSOP attempt  Take the next steps and become master level deuce or Thrice.  Time to step up your game.

Those who want notifications, have options so that is a non-issue based on this ORIGINAL topic thread.

Peace out peeps, take care and thanks for all the fish.

Edited November 1 by js28194

[ginjaninja 667]

two ranges probed me today 185.220.236.0/24   188.253.126.0/24, not sure why im so popular. 1st was using my usernames, 2nd was using a credentials list of no relevance to me.