Illegal Login - How do I stop this?

R

Rockjaw

Young grasshopper
Jun 23, 2024
48
12
Canada
Good morning everyone,

I came downstairs this morning and noticed I had 18 alerts on my monitor. I have attached a picture of the screen. I am running DMSS (but I have unplugged my network cable now) until I can figure this out. Any ideas or help on what to do?
 
For some reason the attachment isn't showing when I attach it :/ I could maybe send it through a private message if anyone can help. it looks like this but there's 18 messages

Abnormal Event Time Event Type Event Info

1 2025-9-14 03:53:50 Illegal Login admin159.xxx.xxx.xxx
2 2025-9-13 23:09:43 Illegal Login admin159.xxx.xxx.xxx
3 2025-9-13 19:51:39 Illegal Login admin159.xxx.xxx.xxx
4 2025-9-13 16:37:13 Illegal Login admin159.xxx.xxx.xxx
5 2025-9-13 14:57:24 Illegal Login admin159.xxx.xxx.xxx
6 2025-9-13 11:08:02 Illegal Login admin159.xxx.xxx.xxx
7 2025-9-13 07:23:30 Illegal Login admin159.xxx.xxx.xxx
8 2025-9-13 03:54:16 Illegal Login admin159.xxx.xxx.xxx
9 2025-9-13 00:00:45 Illegal Login admin159.xxx.xxx.xxx
10 2025-9-12 19:23:49 Illegal Login admin159.xxx.xxx.xxx
11 2025-9-12 15:42:08 Illegal Login admin159.xxx.xxx.xxx
12 2025-9-12 11:55:18 Illegal Login admin159.xxx.xxx.xxx
13 2025-9-12 08:08:38 Illegal Login admin159.xxx.xxx.xxx
14 2025-9-12 04:17:23 Illegal Login admin159.xxx.xxx.xxx
 
Last edited:
bigredfish said:
What is sending the message? Your router? Or the NVR?

Either way, are you port forwarding your router to allow remote access to your video? If so, thats the problem
Click to expand...
Good morning, I'm not sure what is sending the message. I had the alarm icon show up on my monitor (where I see my camera). I logged into my router and I had 2 port forwarding entries on my list (I think from when I had a website setup). I have removed them now. Should be good now?
 
That message seems to indicate they were successful. So maybe maybe not.
Or it could just show attempts, not actual logins if thats the NVR warning message


You're probably ok, but anyone anal about security would tell you to take additional measures to be sure your network isnt compromised.
Depends on if they were able to gain access to other devices on your network.
I'm not network security expert.

But its most likely these were simply attempts due to port forwarding.
 
bigredfish said:
That message seems to indicate they were successful. So maybe maybe not.
Or it could just show attempts, not actual logins if thats the NVR warning message


You're probably ok, but anyone anal about security would tell you to take additional measures to be sure your network isnt compromised.
Depends on if they were able to gain access to other devices on your network.
I'm not network security expert.

But its most likely these were simply attempts due to port forwarding.
Click to expand...
I'm wondering the same thing. Not sure how I would know if they got into my network.
 
Not sure why I can't attach pictures. I click the upload and it never posts. I'll type it all out

1 : 2025-09-14 : 09:57:14 : User Logged in <Local Login>
2 : 2025-09-14 : 07:58:00 : User Logout <Local Login>
3 : 2025-09-14 : 07:47:56 : Saved <Disarming> config
4 : 2025-09-14 : 07:47:55 : Saved <Disarming> config
5 : 2025-09-14 : 07:47:38 : User Logged in <Local Login>
6 : 2025-09-14 : 06:58:34 : User Logout <Local Login>
7 : 2025-09-14 : 06:47:11 : User Logged in <Local Login>
8 : 2025-09-14 : 03:53:50 : Illegal Login : <159.146.61.131,admin>
9 : 2025-09-14 : 03:53:50 : Login failed <admin>
 
That tells me they tried and failed

2025-09-14 : 03:53:50 : Illegal Login : <159.146.61.131,admin>
2025-09-14 : 03:53:50 : Login failed <admin>

Very common when you port forward. Most of its automated.

High chance you're fine.

1- Change your NVR password (may need to change the ones on the cameras to match if using a Dahua NVR with PoE and you plugged them in without changing the pass as they will by default assume the same pass as the admin/NVR

2- Dont port forward.

3- Learn about VPNs (openVPN, WireGuard) and/or think about turning on P2P on the NVR and adding the NVR to the DMSS mobile app using its serial number
 
  • Like
Reactions: Flintstone61
bigredfish said:
That tells me they tried and failed

2025-09-14 : 03:53:50 : Illegal Login : <159.146.61.131,admin>
2025-09-14 : 03:53:50 : Login failed <admin>

Very common when you port forward. Most of its automated.

High chance you're fine.

1- Change your NVR password (may need to change the ones on the cameras to match if using a Dahua NVR with PoE and you plugged them in without changing the pass as they will by default assume the same pass as the admin/NVR

2- Dont port forward.

3- Learn about VPNs (openVPN, WireGuard) and/or think about turning on P2P on the NVR and adding the NVR to the DMSS mobile app using its serial number
Click to expand...
Thank you for your responses. Just changing the local Admin password and I got a question, "Do you want to Sync Password to remote device accessed by private protocol?"
 
That would in theory be YES if all Dahua cameras plugged into the NVR PoE ports and are all using the default NVR credentials

I say in theory only because I've never done it.

Worst case you would end up having to manually change each camera password OR use the little pencil Edit button to tell the NVR what the cameras password are.


NewCamRegPage.jpg
 
  • Like
Reactions: Flintstone61
bigredfish said:
That would in theory be YES if all Dahua cameras plugged into the NVR PoE ports and are all using the default NVR credentials

I say in theory only because I've never done it.

Worst case you would end up having to manually change each camera password OR use the little pencil Edit button to tell the NVR what the cameras password are.


View attachment 228130
Click to expand...
Thank you. I found the camera password and it was changed when I did the admin on the NVR. I tested it and it is good. Thank you so much for your help.
 
Last edited:
  • Like
Reactions: Flintstone61 and bigredfish
Curious.
Why port forward at all?
VPN is the way to go.
2nd choice, P2P. P2P has it's down sides for sure...but still better than port forwarding.
 
  • Like
Reactions: Flintstone61
I use both.

For day to day I’ve gone to P2P on the 7 NVRs I manage. (My own and 5 friends)

I also have WireGuard and OpenVPN available on 5 of those if needed (mostly to access the router)

Router and firewall logs tell the story. The current implementation if Dahua P2P works very well. It’s a true P2P connection with a Dahua discovery server in the middle to provide the introduction. Once the handoff takes place, video does not go through Dahua servers

It’s easy, fast, and built-in to Dahua NVR and DMSS and it just works.
 
  • Like
Reactions: looney2ns and Flintstone61
Holbs said:
Curious.
Why port forward at all?
VPN is the way to go.
2nd choice, P2P. P2P has it's down sides for sure...but still better than port forwarding.
Click to expand...
I used to run a VMWARE (Virtual Box) for a few operating systems I had configured on my computer as well as hosted my own website and I had to open up port forwarding so the DNS from my website would resolve. That's why I had it open, nothing to do with the cameras.
 
You must log in or register to reply here.
Top Bottom