Need help understanding how the following happened. I am definitely not an expert. The following hacking attempt happened to my HomeAssistant server from an IP address in Singapore, and I am trying to figure out how they got through my firewall default deny WAN rule. I have no ports open or forwarde…

would love any insights or comments you might have… seems the would be attacker was using a MacIntosh… I am on Windows. could it be my HASS server is compromised and advertising its location to the outside ? or woudl it be my windows machine which I use to log-in to the HASS server ?

What is running your network firewall (not local devices firewalls)?

I have pfSense, with default deny all rule on the WAN side… no open ports or NAT, UPnP disabled…

is it possible for the HASS server to be infected ? and if so how can I check and dis-infect ? I have a stand-alone Beelink mini-PC as my HASS server…

[image] Is this normal? OpenAI and Anthropic bots poking around I see this security warning in my log. It’s coming from localhost, which is confusing. If I didn’t know better, I’d say bots are scrubbing the web and happened to come along my account, then trie…

[image] zook: pfSense, with default deny all rule on the WAN side That’s fine. Is that the only rule? If not what about other rules? Also how do you reach back to your HA when you are out and about? Or you simply don’t do that? pfsense should have got plenty of logs and this event should sh…

Thank you for that; I’ve read the post. However, in my case the “attack” came from the outside (Singapore according to the IP geolocation) and somehow it knew the LAN IP for my HASS server… I use the Nabu Casa suscription to access my HASS from outside.

Thanks for the notes ! I do have outbound firewall rules, but absolutely no inbound rules for the WAN. I’ve checked the State Table in pfSense, and my HASS server has 3 states active, none of them is for the IP in question: all HomeAssistant server (HASS) states: 10.121.1.60 → 3.216.7.170 Amazon…

I have several IoT devices, Shelly, Leviton, EveryThingHome, Hikvision… and the one PC and HASS server on the LAN.

I am also inquiring with the pfSense forum, and this is a recent comment I got, when I stated I used Nabu Casa’s service for acessing my HASS instance from the outside: “Oh geez, that should have been your first suspect. A remote access service for your home assistant. Someone is likely scanning th…

Hacking attempt

Configuration

NathanCu (Nathan Curtis) September 11, 2026, 7:51pm 6

^^ same answer as this thread.

Script kiddies. (now named LLM automated harvesting) How do you expose your HA to the internet.