Assistance please turnt my server off today due to electrical work in my house and upon turning back on I'm getting the error Possible Hack Attempt the syslog shows the IP for the router but shown differnet invalid usrs login attempts, any idea what this can be ? 

 

Provider is Vodafone and it does have secure net so not sure if it's this causing it 

 

As far as I'm aware Plex is only thing that can assess outside my network via UPnp, I have no interest in access my server outside the network other than plex

 

vault101-diagnostics-20250515-2307.zipvault101-syslog-20250515-2206.zip

Adding update have rebooted and fix common problems no longer has alert and logs no longer being spammed but still looking for advise on this to see what caused it and how to provent it thanks in advance for the help 

Since you say the address appears to be the router it is possible that it is some sort of security feature built into the router?

3 hours ago, itimpi said:

Since you say the address appears to be the router it is possible that it is some sort of security feature built into the router?

any idea how to fully rule this out ?

I do know old provide BT had no issues

1 hour ago, LoyalScotsman said:

any idea how to fully rule this out ?

By looking at the spec of the router to see if it has such a feature!   

 

If not then there is I guess a slight chance your router has been hacked although that seems unlikely.

Could this be the (weirdly common) IPV6 devices being public and completely open without you knowing issue that many routers have by default?

Actually finding an open IPV6 service is quite hard as there are an incredible number of them, but there are so many devices in people homes just running completely open to WAN, no NAT no Firewall and that's just how it is with IPV6 on so many routers, and the more ISPs enable IPV6 by default, the more this will become an issue.