Login Attempt Failed from Unifi Router?

I got some weird notifications in HA today with "Login attempt failed, Login attempt or request with invalid authentication from ubnt (192.168.12.1). See the log for details.

My router is a Ubiquiti Unifi USG 4 Pro. Never had this notification before… It seems like the router is trying to connect to HA, sometimes it retries every 10 minutes, weird!

I have NO Unifi related integrations installed… Could this be a nefarious attempt? How can i figure out what is going on?

And yes, HA is normally exposed to the internet and for now i just cut the port forward until i can figure out what is going on…

Any help is much apreciated!

Can you provide the actual HA log, and if possible a matching ubnt log for the same time when you received these login attempts?

It can always be a nefarious attempt.

Do you firewalling the edge with the USG4Pro?
Do you have ample restrictions on the traffic to/from HA?
How do you have secure your network edge?

HA Logs showed nothing but critical elements at that time (and nothing about failed logins)… The Router logs i cannot find, even after hours of googling… and sshing into the device doesn’t work for some reason (with correct user and pass used and it’s been like that since way before this happened)…

I did notice that night that one of my wall mounted tablets couldn’t reconnect to HA, so i rebooted and reconnected it. The next morning i checked and i had no more notifications regarding failed logins and re-enabled port forwarding and no notifications since.

I use the built in Unifi threat management basically set to max with detect & block. I don’t have any other ports forwarded.

When it comes to restrictions around the port forwarding, i cannot do much since i mainly use it for mobile access from outside the home (where 4g/5g internet on our phones don’t have fixed ip’s to consider restricting connections from specific ip’s)

Maybe the tablet that couldn’t connect was the culprit? But that would show it’s ip, not the router’s…

i will continue to try to collect the unifi logs from that day and post them here.

Hey everyone, I’ve been getting a “Login Attempt Failed” notification from my Unifi router. I haven’t tried logging in recently, and it’s starting to worry me. Has anyone else experienced this? What could be causing it?

I got the same today actually.

I Got The Same Issue When I login.

I got the same today actually. Plz Help

I faced similar issue some time ago from my Draytek router. After some investigation it turned out that that was completely unrelated service running on my LAN that was reaching back to HA…
For details; it was caused by Homepage dashboard where I have HA specific widget configured. Access token for this widget expired casuing login issues… Strangely, as it was configured for accessing HA not by its local IP but by public URL, so the issue appeared to be originated by router due to redicting traffic from LAN to HA via NAT loopback.
Perhaps this might be similar case for your cases?