IP from Google trying to access my HA /api/config. Should I worry?

Configuration
1

When I came back home and login to my HA, I saw this popping up in the notification:

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:138
Integration: HTTP (documentation, issues)
First occurred: 8:18:45 PM (1 occurrence)
Last logged: 8:18:45 PM


Login attempt or request with invalid authentication from xx.xx.xx.xx.bc.googleusercontent.com (xx.xx.xx.xx). Requested URL: '/api/config'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36)

I have seen this from home IPs generated by phone app logins, but never saw originated from Google IPs. Is this caused by some misconfigured addons/integrations? Should I be worried?

2

Yes.
Install WireShark and narrow it down.
Is it malware, misconfiguration, DNS, snooping, a rogue app, backdoir advertising, or somebody piggybacking onto your network? Your network. Your equipment. Your money. How dare they!!! (Hint: they do, more than most ever imagine)

Clifford Stoll found an early hacker because his employer’s phone bill was always out by 75 cents. He wrote a book about it called The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage - worth reading to gain a historic perspective on rogue activity.

It may all be quite innocuous, but unless you further investigate, how will we all know?

3

Likely someone running an app in Google Cloud Platform (gcp), that is scanning IP addresses looking for port 8123. Sounds like you have that port open to the internet?

4

Yes.
Don’t know why Tailscale is not working well with my wife’s phone - it does not connect to network with that VPN on demand option, and could not post her cell location to HA via the app, so I funnel HA to Internet instead. That was clearly an oversight

5

There are folks here that do that - open 8123 on the internet. IMO, it’s not a great approach as it is a single layer of defense - as you’ll be counting on HA and it’s included libraries to have no security vulnerabilities. VPN or Nabu Casa on top - like you are trying to do - is definitely better.

6

I used a reverse proxy so don’t open port 8123 and still see these occasionally.

The logs usually show someone scanning wordpress url’s.

As an extra layer of security, I also have fail2ban installed on my reverse proxy that handles my incoming traffic.