i got a Remote login from a unknown host.
Tue Sep 1 09:34:54 2026 authpriv.info dropbear[2371]: Child connection from 110.173.190.221:51520
Tue Sep 1 09:34:57 2026 daemon.notice netifd: Network device 'eth1' link is down
now i have a really really bad feeling. i was meaning that the Extern SSH was disabled. (Now it is, and changed the PW)
DHCP/DNS/Samba server has no Logins from the router ip
i have no glue what the attaker wanted. but please check your securtiy settings
Source: r/GlInet · by /u/moppi79