Is this a hacking attempt?

[pwhodges 2132]

55 minutes ago, ginjaninja said:

two ranges probed me today 185.220.236.0/24   188.253.126.0/24, not sure why im so popular. 1st was using my usernames, 2nd was using a credentials list of no relevance to me.

Everyone's popular on the Internet.

Have you not told Emby to hide your user names from the remote login screen?

Paul

[js28194 76]

This is getting exhausting.  This is NOT I REPEAT an EMBY Issue.  This is YOU issue.  Take the next steps to read and learn how to move on how mitigate and protect the applications that you have purchased or licensed to use with remote access.  Those tools are available to you and it's on you to learn 'em.  I don't care what Staples said, there is no EASY button.

I (and some others) don't want to know how YOU are getting probed, or scanned every single time... unless you include videos, then you might as while join onlyfans which I won't pay for.

Please stop conflating your internet scans, probes and obvious logins with usernames and passwords (as much I would like to have some of my own, preferably physically) to "Is my EMBY HACKED?"

Yes, Yes, and Yes, you are ALWAYS getting scanned and "probed" and how this is new to people is brain breaking.

I'll give you once last screenshot of my firewall and I swear, I am not responding in this thread anymore.  

Can we close this thread already?

Edited November 2 by js28194

[ng4ever 42]

On 10/21/2026 at 6:04 PM, Luke said:

That's not currently built in, but it could be easily added.

Thank you. 

[geomusicmaker 5]

Same thing happened to me yesterday Someone's doing the rounds I guess. So long as it doesn't say someone authenticated, that means they gave up right?

[moviefan 190]

14 minutes ago, geomusicmaker said:

Same thing happened to me yesterday Someone's doing the rounds I guess. So long as it doesn't say someone authenticated, that means they gave up right?

Well, the authentication wouldn't show up in this log to be clear.  This is only showing the failures.  But yes if they didn't authenticate then they likely eventually gave up.

[TMCsw 317]

5 hours ago, moviefan said:

Well, the authentication wouldn't show up in this log to be clear.  This is only showing the failures.  But yes if they didn't authenticate then they likely eventually gave up.

But it will show up under Activity on the Dashboard.

[jeanlucpicard 24]

On 11/2/2026 at 11:30 PM, ginjaninja said:

two ranges probed me today 185.220.236.0/24   188.253.126.0/24, not sure why im so popular. 1st was using my usernames, 2nd was using a credentials list of no relevance to me.

when you put screenshots in any forum, try to anonymize your username, and use paint or image editor to cross out personal information such as your public ip address or username. bots can also scan emby forums to planify attacks. 

[HolyGigi 13]

Happened to me too a few weeks ago. I used Caddy and set up rate limit on login: to 2 max attempts per 30min, after that ban ip. Also only whitelisted my own country Ip ranges.