# Anyone know what this is?
**URL:** https://discourse.nodered.org/t/anyone-know-what-this-is/94242
**Category:** General
**Tags:** security
**Created:** [29 December 2024 17:54 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242 "2024-12-29T17:54:20Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Cathprotech](https://discourse.nodered.org/u/Cathprotech)
#### Post date: [29 December 2024 17:54 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242/1 "2024-12-29T17:54:20Z")
I have not used Node-Red for quite some time now and I noticed it was still running on my RPi4.
I opened the web server page only to be greated with this: (Hopefull the image is below).
First thing is, none of my flows are there and only this flow is installed, secondly I have no idea what this flow is and how it got there.
I'm guessing that my Node-Red has been hacked or something nasty has got onto my RPi4.
Of course I will format the SD card and start again, but I wonder if anyone knows what it is and what its purpose is.
Is it possibly linked to IP Royal Pawn because I noticed my router has a number of open ports listed as ip.royal.paw and linked to my RPi4. I'm suspecting that they could be related.
Edit: Just to note, the only other thing running on my RPi4 is Octoprint which is its current primary use.
Thanks
Martin
---
### Author:  [@GogoVega](https://discourse.nodered.org/u/GogoVega)
#### Post date: [29 December 2024 17:57 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242/2 "2024-12-29T17:57:56Z")
In short: you have been hacked
---
### Author:  [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)
#### Post date: [29 December 2024 18:01 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242/3 "2024-12-29T18:01:48Z")
That there is the hallmark of your system being hacked!
- Take it offline
- Close any open ports on your router (also check it for infected Firmware)
- Wipe it (the Pi4)
- Check all network connected equipment (better to be safe)
- Start over
- Never open up ports to Node RED, without knowing how to correctly secure it.
see here: [Safely accessing Node-RED over the Internet](https://discourse.nodered.org/t/safely-accessing-node-red-over-the-internet/45024)
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [29 December 2024 18:12 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242/4 "2024-12-29T18:12:14Z")
If you forwarded port 1880 on your router so that you could access Node-red from the Internet, bad servers out there would have quickly noticed the open port.
Then they would have been free to try and crack your Node-red password (You did set a password?) and how ever long it took them you probably would not notice.
Services on a Raspberry Pi are especially juicy hacking targets because by default the normal login account has superuser powers.
Node-red especially so because it has a Web interface but can run operating system commands.
Don't let this put you off Node-red, just flash a new SD card, install Node-red and this time follow the guidance on securing it.
But first of all, turn off port forwarding and never turn it back on!
---
### Author:  [@Cathprotech](https://discourse.nodered.org/u/Cathprotech)
#### Post date: [6 January 2025 08:40 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242/5 "2025-01-06T08:40:21Z")
Thanks everyone.
I got a new SD card and a fresh install. It is not open to the internet and I have checked everything else on my network and all is ok.
It's been over a week now and there are no strange entries on my router (port forwarding).
Thanks again
Martin
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [6 January 2025 12:35 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242/6 "2025-01-06T12:35:31Z")