Hi @lechi
There is most likely a device in your local network that is trying to login with wrong credentials. Could be a phone or a tablet with DAVx5 or a computer with the desktop client installed.
The problem in many home and SOHO networks is that NAT loopback is used to acces the Nextcloud server via domain name and therefore all devices inside the local network access the server via the same IP address. This IP address then gets blocked when one device triggers the brute force protection, and then all other devices are affected too. The second possibility that can cause this issue, is a reverse proxy that does not correctly forward the IP addresses of the respective devices to the Nextcloud server.
The first case can be solved with a local DNS server, DNS overrides in your router if your router suports it or by simply whitelisting the IP address from which all your device access your Nextcloud server with this app. The second case can be solved with a correct reverse proxy configuration. I would not recommend whitelisting the reverse proxy’s IP, because by doing so you effectively disable the brute force protection also for devices that connect to your Nextcloud from the internet.
If IPs geting blocked by the bruteforce protection, you should actually see the corresponding IP address in the Nextcloud logs and thus be able to draw conclusions about what to do…