Login attempt from unused IP Address

Configuration
1

Hi There,

i am getting the meaasge:
Login attempt or request with invalid authentication from 192.168.1.100

192.168.1.100 is the first DHCP Address. It is used by a synology disk station, to which I have some ports forwarded to.

BUT currently the disk station is off and the IP address is not used (as by the overview in the router, and a complimentary ping check by me).

question: could it be:

  1. An attack from outside via the forwarded port
  2. another compromised device in the network
  3. a faulty log?
  4. …?
2

If the device at 1.100 is off, there is no service to respond to any traffic from a port forward. From the outside it shouldn’t even be seen.

How do you have your Home Assistant configured? Are you forwarding to that?

3

yes, i am forwarding :8123 to my PI running HA on Debian,

4

What is your network setup

5

i am not sure what you mean …

  • crappy plastic router, 2.4 and 5ghz wifi , mostly everything on DHCP, some port forwards to some raspberrys and other things
  • some IoT devices such as Tasmotized sonoffs, amazon dash buttons, yee-lights and such
  • HA running on Debain, connected via cable to router (disabled wifi on pi)
  • PI-Hole running on the same PI than HA
  • node-red running on another PI somewhere

I start to think it’s just the router switching devices on 1.100

6

Was just trying to make sure you didn’t have another router that was incorrectly configured trying to do some weird dual NAT or anything