Illegal Login - How do I stop this?

R

Rockjaw

n3wb
Jun 23, 2024
28
4
Canada
Good morning everyone,

I came downstairs this morning and noticed I had 18 alerts on my monitor. I have attached a picture of the screen. I am running DMSS (but I have unplugged my network cable now) until I can figure this out. Any ideas or help on what to do?
 
For some reason the attachment isn't showing when I attach it :/ I could maybe send it through a private message if anyone can help. it looks like this but there's 18 messages

Abnormal Event Time Event Type Event Info

1 2025-9-14 03:53:50 Illegal Login admin159.xxx.xxx.xxx
2 2025-9-13 23:09:43 Illegal Login admin159.xxx.xxx.xxx
3 2025-9-13 19:51:39 Illegal Login admin159.xxx.xxx.xxx
4 2025-9-13 16:37:13 Illegal Login admin159.xxx.xxx.xxx
5 2025-9-13 14:57:24 Illegal Login admin159.xxx.xxx.xxx
6 2025-9-13 11:08:02 Illegal Login admin159.xxx.xxx.xxx
7 2025-9-13 07:23:30 Illegal Login admin159.xxx.xxx.xxx
8 2025-9-13 03:54:16 Illegal Login admin159.xxx.xxx.xxx
9 2025-9-13 00:00:45 Illegal Login admin159.xxx.xxx.xxx
10 2025-9-12 19:23:49 Illegal Login admin159.xxx.xxx.xxx
11 2025-9-12 15:42:08 Illegal Login admin159.xxx.xxx.xxx
12 2025-9-12 11:55:18 Illegal Login admin159.xxx.xxx.xxx
13 2025-9-12 08:08:38 Illegal Login admin159.xxx.xxx.xxx
14 2025-9-12 04:17:23 Illegal Login admin159.xxx.xxx.xxx
 
Last edited:
What is sending the message? Your router? Or the NVR?

Either way, are you port forwarding your router to allow remote access to your video? If so, thats the problem
 
  • Like
Reactions: SpacemanSpiff
bigredfish said:
What is sending the message? Your router? Or the NVR?

Either way, are you port forwarding your router to allow remote access to your video? If so, thats the problem
Click to expand...
Good morning, I'm not sure what is sending the message. I had the alarm icon show up on my monitor (where I see my camera). I logged into my router and I had 2 port forwarding entries on my list (I think from when I had a website setup). I have removed them now. Should be good now?
 
That message seems to indicate they were successful. So maybe maybe not.
Or it could just show attempts, not actual logins if thats the NVR warning message


You're probably ok, but anyone anal about security would tell you to take additional measures to be sure your network isnt compromised.
Depends on if they were able to gain access to other devices on your network.
I'm not network security expert.

But its most likely these were simply attempts due to port forwarding.
 
bigredfish said:
That message seems to indicate they were successful. So maybe maybe not.
Or it could just show attempts, not actual logins if thats the NVR warning message


You're probably ok, but anyone anal about security would tell you to take additional measures to be sure your network isnt compromised.
Depends on if they were able to gain access to other devices on your network.
I'm not network security expert.

But its most likely these were simply attempts due to port forwarding.
Click to expand...
I'm wondering the same thing. Not sure how I would know if they got into my network.
 
Show your NVR log
 
Not sure why I can't attach pictures. I click the upload and it never posts. I'll type it all out

1 : 2025-09-14 : 09:57:14 : User Logged in <Local Login>
2 : 2025-09-14 : 07:58:00 : User Logout <Local Login>
3 : 2025-09-14 : 07:47:56 : Saved <Disarming> config
4 : 2025-09-14 : 07:47:55 : Saved <Disarming> config
5 : 2025-09-14 : 07:47:38 : User Logged in <Local Login>
6 : 2025-09-14 : 06:58:34 : User Logout <Local Login>
7 : 2025-09-14 : 06:47:11 : User Logged in <Local Login>
8 : 2025-09-14 : 03:53:50 : Illegal Login : <159.146.61.131,admin>
9 : 2025-09-14 : 03:53:50 : Login failed <admin>
 
That tells me they tried and failed

2025-09-14 : 03:53:50 : Illegal Login : <159.146.61.131,admin>
2025-09-14 : 03:53:50 : Login failed <admin>

Very common when you port forward. Most of its automated.

High chance you're fine.

1- Change your NVR password (may need to change the ones on the cameras to match if using a Dahua NVR with PoE and you plugged them in without changing the pass as they will by default assume the same pass as the admin/NVR

2- Dont port forward.

3- Learn about VPNs (openVPN, WireGuard) and/or think about turning on P2P on the NVR and adding the NVR to the DMSS mobile app using its serial number
 
bigredfish said:
That tells me they tried and failed

2025-09-14 : 03:53:50 : Illegal Login : <159.146.61.131,admin>
2025-09-14 : 03:53:50 : Login failed <admin>

Very common when you port forward. Most of its automated.

High chance you're fine.

1- Change your NVR password (may need to change the ones on the cameras to match if using a Dahua NVR with PoE and you plugged them in without changing the pass as they will by default assume the same pass as the admin/NVR

2- Dont port forward.

3- Learn about VPNs (openVPN, WireGuard) and/or think about turning on P2P on the NVR and adding the NVR to the DMSS mobile app using its serial number
Click to expand...
Thank you for your responses. Just changing the local Admin password and I got a question, "Do you want to Sync Password to remote device accessed by private protocol?"
 
That would in theory be YES if all Dahua cameras plugged into the NVR PoE ports and are all using the default NVR credentials

I say in theory only because I've never done it.

Worst case you would end up having to manually change each camera password OR use the little pencil Edit button to tell the NVR what the cameras password are.


NewCamRegPage.jpg
 
bigredfish said:
That would in theory be YES if all Dahua cameras plugged into the NVR PoE ports and are all using the default NVR credentials

I say in theory only because I've never done it.

Worst case you would end up having to manually change each camera password OR use the little pencil Edit button to tell the NVR what the cameras password are.


View attachment 228130
Click to expand...
Thank you. I found the camera password and it was changed when I did the admin on the NVR. I tested it and it is good. Thank you so much for your help.
 
Last edited:
  • Like
Reactions: bigredfish
You must log in or register to reply here.
Top Bottom