your note has made me smile. Yes, what you say would be WONDERFUL !! A few years ago, while watching YouTube, I ran into a series of vids where a fellow with blue/purple hair was wasting spam-callers time and annoying them. I commented he shoudl be sending them malware if it was possible. Recently I see that he has adopted the mindset you mention.
It would be awesome to do what you say – bring the terror to them (Digital GWOT ?)… Unfortunately I am not versed in hacking, and delving into the Dark Web to buy malware seems quite a risk.
I totally agree that being passive just invites more and more uninvited attempts to mess with things – if you come up with a solution please keep me in mind ! Maybe it can start at the firewall level, where a WAN prober gets swarmed after a number of attempts ?
What would it take for the “good guys” to implement such a thing globally ?
Maybe we can start with the IP in this instance ? you have any apps that do DDoS attacks that you can share ?
The ASYMMETRICAL FAVOR FLIP campaign, starting here.
Don’t like it - do something about it! Don’t accept fate and shrug your shoulders thinking it is innocent skript kiddies. It is not. These people have a clearly focused agenda, and goodwill is not on it. Grasp the opportunity and change your future.
Why is Alphabet charging the advertiser to force you to watch an advertisement, to lose a minute of your time, and the advertiser is not paying you when you click on it?
Why do you need to always be one step ahead of every terrorist, and get it right each and every time, but for them they only have to get it right once to be successful?
am with you Bud… there are soooo many things wrong with this new world… as opposed to what was the 1980’s and before… I could go on, and on, but we all know it… we are getting over-run by the terrorists, the un-educated, the religious fanatics, etc. etc. etc, and there are getting to be more of them all the time… and the Woke’s in Gov. are not helping… social media and the constant pursuit of attention… etc. etc. etc…
I think we are getting a bit off topic and into the deeeeeep weeds of the world these days..
You have an HomeAssistant event being logged for an inbound attack.
It contains the IP Address of the inbound session.
HomeAssistant can respond to trigger events.
These can be logged, collated, and responded to.
Looks around, not just behind, over shoulder, missile launcher at the ready.
Can I fire off an automated abuse report to their ISP if the attacks are persistent? I note your initial report was from a Cloudflare IP Address and they have their own banning algorithms.
I note I have a fast, non-static, IPv4 internet connection with unlimited traffic. It is not used for DDOS attacks.
Log details (WARNING)
Logger: homeassistant.components.http.ban
…
First occurred: 12:49:40 (1 occurrence)
Last logged: 12:49:40
Login attempt or request with invalid authentication from 104.28.222.47 (104.28.222.47). Requested URL: ‘/api/config’. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36)
Same IP as well.
I am not exposing my Home Assistant instance via port forwarding or UPnP, only through Nabu Casa Remote Access.
Until now, I had assumed that the randomized public hostname, such as 0123456789abcdef....ui.nabu.casa, together with Nabu Casa’s SNI-based routing, would at least keep most opportunistic automated scanning away.
However, the point about Certificate Transparency logs makes sense and had not crossed my mind before. Since the hostname appears in a publicly trusted certificate, it can in principle be harvested from CT logs. That would provide a plausible explanation for how automated scanners could discover Nabu Casa-hosted instances without knowing the URL beforehand.
I am not suggesting that a randomized URL should be treated as an authentication mechanism. Proper authentication is obviously still the real security boundary. But the randomized hostname was, at least in my view, a useful additional layer of obscurity that probably filtered out a lot of generic “try my luck” scanning.
The fact that multiple users are seeing the exact same source IP and /api/config request pattern is especially interesting.
Security by obscurity is not and has never been security. The threat that exists here existed long before you were aware of it. Which is the only thing that has changed.
I’ve had an additional attempt (see log entries below) on my HASS last night as well, from a different IP. I have disabled Remote Access from my Home Assistant Cloud services. The two log entries after the hacking attempt seem to be related to the remote access links ? also of notice are the URLs or directories the hacker tried to access ?
Logger: homeassistant.components.http.ban
Source: components/http/ban.py:138
Integration: HTTP (documentation, issues)
First occurred: September 20, 2026 at 11:01:41 PM (3 occurrences)
Last logged: September 20, 2026 at 11:01:41 PM
Login attempt or request with invalid authentication from 45.61.187.50 (45.61.187.50). Requested URL: ‘/media/system/js/core.js’. (Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from 45.61.187.50 (45.61.187.50). Requested URL: ‘/media/jui/js/bootstrap.min.js’. (Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from 45.61.187.50 (45.61.187.50). Requested URL: ‘/media/vendor/jquery/js/jquery.min.js?3.6.0’. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36)
====================================================
Logger: snitun.multiplexer.core
Source: runner.py:280
First occurred: 9:15:09 AM (2 occurrences)
Last logged: 9:15:29 AM
Timed out reading and writing to peer
Timeout error while pinging peer
=====================================================
Logger: hass_nabucasa.iot
Source: runner.py:280
First occurred: 9:20:45 AM (1 occurrence)
Last logged: 9:20:45 AM
was wondering if an “IP Ban” can be implemented in the login portal, such that it would ban the login attempts from the IP after 3 attempts (or other user specified number of attempts)… ? this woudl make the hacker have to change IPs often…?
EDIT – well, apparently I did know (must have done it quite a while ago, and forgot), as I had it turned on already and set to 6 attempts; changed to 3. At least this way the attempt will be stopped after 3 tries, though not sure keeping a record of the blocked IP helps as it seems the hacker is using VPS instances, and will change VPS/IP at will. I enabled MFA login for my user, but not sure if this helps the other users such as “Home Assistant Cloud”, “Home Assistant Content” and “Supervisor” from being used to log into my HASS instance, or what passwords they use ? …or are these “users” not able to log in at all using the Nabu Casa Cloud link ?
…or am I totally out to lunch ? I would think the hacker does not know my username (it is not “zook”)
