Exception HMAC does not match

So you were DDoS’ed, in a way. Look in the logs what they were looking for. If this was WordPress, like all others, or Drupal or Joomla or something, then there is no reason to worry, these were automated bot scans. They simply stopped scanning your IP.

BTW, my errors started in December too.

However, if they were trying Nextcloud specific URLs or even usernames then it might mean someone zeroed in on you and they now know there is a Nextcloud server running at that IP and now they may quietly start trying Nextcloud specific hacks. So, double check your logs and your traffic. Most likely though, the bot just moved on to another target.

This is just the unavoidable side effect of trying to run a server that is opened to the world.

Over 20-25 years ago I was setting up an FTP server and for a brief period of 5-10 minutes where I mistakenly opened anonymous public uploads, someone started uploading warez and porn. 20 years ago when few people even had internet access. Imagine what kind of swamp the web is these days.

Got this error today on NC 33. Wow this has been error since 2024 and no one seems to fix this. lol

I realized I also see exclusively Microsoft IPs causing this. It’s a slightly different set of IPs than in the post above, but mostly from the same subnets and all I have checked with whois are from microsoft…

This note in the issue might help you:

If you are a user of Nginx Proxy Manager (NPM), try disabling the Cache Assets setting in your NPM configuration. This often resolves the problem.

First of all: I’am a Nextcloud user searching for a solution for the ‘Exception HMAC does not match.’ error message. After scanning the discussion in this threat I looked to the HMAC error messages.
The IP addresses in these notifications are all from countries that are abroad to me. Most of these IP addresses appear to belong to the ISP Microsoft.

Because my Nextcloud users do not come from these IP addresses, I have decided to block these IP addresses in the firewall. For UFW, the command is:
ufw deny from ip-address

Can confirm that these errors are triggered by Microsoft bots trying to access a bunch of files:

51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6529
51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /gptsh.php HTTP/1.1" 404 426
51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /xocx.php HTTP/1.1" 404 426
51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /sodas.php HTTP/1.1" 404 426
51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /zaz.php HTTP/1.1" 404 426
51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /lupo.php HTTP/1.1" 404 426
51.120.83.8 - - [27/Mar/2026:01:33:00 +0100] "GET /bm.php HTTP/1.1" 404 426

and so on…

These then trigger the following errors:

[Fri Mar 27 01:33:00.491559 2026] [proxy_fcgi:error] [pid 139420:tid 139515] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.537610 2026] [proxy_fcgi:error] [pid 139420:tid 139517] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.583318 2026] [proxy_fcgi:error] [pid 139420:tid 139516] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.630595 2026] [proxy_fcgi:error] [pid 139420:tid 139518] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.675241 2026] [proxy_fcgi:error] [pid 139420:tid 139519] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.721768 2026] [proxy_fcgi:error] [pid 139420:tid 139520] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.767795 2026] [proxy_fcgi:error] [pid 139420:tid 139521] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 01:33:00.817862 2026] [proxy_fcgi:error] [pid 139420:tid 139522] [client 51.120.83.8:18089] AH01071: Got error 'Primary script unknown'

Just thought I’d share my findings here, since the descriptions in [Bug]: HMAC does not match. Could not decrypt or decode encrypted session data · Issue #42157 · nextcloud/server · GitHub don’t really apply to my setup (Debian 12, Apache).