8x Login attempt or request with invalid authentication from 185.220.100.254 = Tor-Exit traffic

Configuration
1

I just got 8x of these in my logs. 185.220.100.254 seems a Tor-Exit network address. Any advise?

2020-07-10 11:33:39 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:39 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:40 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:42 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:43 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:44 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:45 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

2020-07-10 11:33:46 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 185.220.100.254

1 Like
2

It is an intrusion attempt.

I was hit from 185.220.101.24 and 62.102.148.68 today.

https://www.abuseipdb.com/check/185.220.101.24

https://www.abuseipdb.com/check/62.102.148.68

Make sure you have a strong password set for all your users and have enabled IPBan.

3 Likes
3

Same here… Had some intrusion attempts today from a TOR network.