AI bot hacking/scraping Home Assistant (lemmy.world)

submitted 5 days ago by gdog05@lemmy.world to c/selfhosted@lemmy.world

34 comments fedilink hide all child comments

I pay for the Nabu Casa subscription for remote access to Home Assistant. Mostly as a way to give them money for a great service, but it's convenient and felt pretty secure. It should be the only remote way into Home Assistant. About an hour ago I got a login attempt notice that an IP was trying to access API/config. The IP is in some bad IP databases. What I found interesting was that the log shows an AI bot. A Google Gemini bot specifically. Makes me worry that AI is going to make yet another aspect of life frustrating and unfun.

you are viewing a single comment's thread
view the rest of the comments

[-] gdog05@lemmy.world 8 points 5 days ago

This one was 66.187.5.19. I tried to find a way to report their behavior on hostodo (the service they're using) but they don't seem to have a report option. I'm guessing because they don't want to prevent this kind of thing.

[-] IsoKiero@sopuli.xyz 7 points 5 days ago* (last edited 5 days ago)

OrgAbuseHandle: ABUSE9107-ARIN

OrgAbuseName: ABUSE

OrgAbusePhone: +1-313-516-8908

OrgAbuseEmail: abuse@hostodo.com

OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE9107-ARIN

They have options. No idea if they actually do anything for the reports, but it's worth a shot.

[-] WhyJiffie@sh.itjust.works 7 points 5 days ago

the whois info for the IP might have an abuse email address, try that

[-] SteveTech@aussie.zone 9 points 5 days ago

Can confirm it does:

OrgAbuseHandle: ABUSE9107-ARIN
OrgAbuseName:   ABUSE
OrgAbusePhone:  +1-313-516-8908
OrgAbuseEmail:  abuse@hostodo.com
OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE9107-ARIN

[-] kylian0087@lemmy.dbzer0.com 1 points 5 days ago* (last edited 5 days ago)

Often you can just send them a email about the behavior, Using their generic contact info.

this post was submitted on 10 Sep 2026

72 points (98.6% liked)

Selfhosted

62139 readers

521 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world