I have a Jellyfin server, NextCloud instance, etc that I share with friends and family. Currently, I serve them over the open-internet using Cloudflare tunnels. Obviously this has some security implications that I don’t love. Also recently one of my domains got flagged as malicious by google and now Chrome browsers won’t go to the site - annoying.
I use Tailscale already to access my server infra remotely, but honestly I don’t see this as a viable option for my non-technical friends and family. Plus, I need to support all kinds of devices like smart tvs. How do you fine folks deal with this issue?
My dynamic public IP recently got flagged by Google and it wouldn’t allow logins to any Google accounts coming from my home, even with multiple correct authentication factors. We could connect though the data plan on our phones without a problem because they got (other) IPs from the mobile carrier, but not through the home ISP. We got security emails asking “is this you?” but confirming did nothing. It went away only when the ISP cycled to another of their public ranges.
Might be way off here but have you checked if you actually got hacked and they just didn’t destroy anything?
I would entertain the possibility if there was any sign, or if I knew how Google takes these decisions.
Honestly, I would just take this as an indicator of something fishy going on. Either google crawled your ip and found things it didn’t like or stuff came out of it to google. Either a scripted action (which looks malicious from the outside) or advertising emails. Your logs should at least tell you if there have been any suspicious logins on any of the exposed services.