Forum Discussion

ChrisJL_2005's avatar
ChrisJL_2005
Tuning in
2 days ago

A Virgin media IP address has attempted to log in my NAS

I have experienced an attempt to break into my NAS drive. My security settings blocked it. 

The NAS sent me a note as follows:

"The IP Address [REMOVED] experienced 3 failed attempts when attempting to log into FTP running on Diskstation within 3 minutes and was blocked at 18.06.2025 07:36."

I have not experienced an attack for over 12 months, so was surprised and went and did a check that my NAS is still secure. 

I did a quick trace of the IP address, and it is based in Liverpool and issued by Virgin Media. 

I assume it is a bot. But who should I notify in Virgin Media that it is hacked? 

Thanks very much. 

 

4 Replies

  • Roger_Gooner's avatar
    Roger_Gooner
    Alessandro Volta
    2 days ago

    This sort of thing happens all the time. If you were to enable Two-Factor Authentication (2FA) it adds an important level of security. Another thing I'd do is to disable the  default "admin" account and use new administrator account.

    • ChrisJL_2005's avatar
      ChrisJL_2005
      Tuning in
      2 days ago

      Thanks for the advice. I run with 2FA.

      I've disabled the default 'admin' sometime ago because of the risk. 

  • Buffer6's avatar
    Buffer6
    Legend
    2 days ago

     IP address [REMOVED], which is assigned to Virgin Media and located in Liverpool. That strongly suggests a bot or automated scanner probing for vulnerabilities.

    Here’s what you can do:

    🛡️ Strengthen Your NAS Security
    Disable FTP if you’re not actively using it. It's notoriously insecure.

    Switch to SFTP or FTPS for encrypted file transfer.

    Use strong, unique passwords—especially for admin accounts.

    Set up IP access control to restrict remote access to known trusted ranges.

    Ensure your NAS firmware is fully up to date to patch known exploits.

    📣 Reporting to Virgin Media
    To report abuse originating from their IPs, email: 📧 abuse@virginmedia.com Include the IP address, timestamp (18 June 2025 07:36), and the log message you received. Keep it factual and concise.

    🔒 Long-term Options
    Consider placing your NAS behind a VPN or reverse proxy if you need remote access.

    Use port knocking or a dynamic DNS service with 2FA.

    Monitor login attempts—Synology, QNAP, etc., often provide alert tools.

    Even if it’s just a bot, blocking and reporting it helps build a picture of wider scan activity.

    • ChrisJL_2005's avatar
      ChrisJL_2005
      Tuning in
      2 days ago

      Thanks for the advice, particularly as to who I should report the incident to.