Nextcloud logs constantly show IP 172.x.x.x

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 33.0.5.1
  • Operating system and version (e.g., Ubuntu 24.04):
    • Debian 1:6.12.75-1+rpt1~bookworm (2026-03-11) aarch64
  • Web server and version (e.g, Apache 2.4.25):
    • Apache/2.4.66 (Debian)
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • Nginx 1.30.1
  • PHP version (e.g, 8.3):
    • 8.4
  • Is this the first time you’ve seen this error? (Yes / No):
    • No
  • When did this problem seem to first start?
    • Unknown
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Binary install
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

So as of now I am getting logs and for some reason a IP Address which has been used by Docker for a Network Bridge (which I created recently) and now deleted is showing up. What this means: in the logs I get sometimes the IP is “172.25.0.1” whereas this IP no longer exists in the device Nextcloud is located in.

Steps to replicate it (hint: details matter!):

  1. Have Nextcloud running
  2. Create a Docker Network Bridge
  3. Check the logs/system information

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.

{
    "reqId": "rj7o3KHUGPGPlKVvii9r",
    "level": 1,
    "time": "2026-06-23T01:55:48+02:00",
    "remoteAddr": "172.25.0.1",
    "user": "Maxim",
    "app": "core",
    "method": "GET",
    "url": "/ocs/v2.php/apps/end_to_end_encryption/api/v2/public-key?format=json",
    "scriptName": "/ocs/v2.php",
    "message": "Bruteforce attempt from \"172.25.0.1\" detected for action \"e2ee\".",
    "userAgent": "Mozilla/5.0 (Macintosh) mirall/33.0.5 (Nextcloud, macos-25.5.0 ClientArchitecture: arm64 OsArchitecture: arm64)",
    "version": "33.0.5.1",
    "clientReqId": "4a2c5e25-69ce-4738-8a4b-0dae52135981",
    "data": {
        "app": "core"
    }
}

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "serverid": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "localhost"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.5.1",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "overwritehost": "***REMOVED SENSITIVE VALUE***",
        "overwritecondaddr": "^192\\.168\\.178\\.188$",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "default_phone_region": "DE",
        "filelocking.enabled": true,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        },
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "pipe",
        "maintenance_window_start": 2,
        "trashbin_retention_obligation": "30, 60",
        "versions_retention_obligation": "180, auto",
        "activity_expire_days": 730,
        "maintenance": false,
        "default_timezone": "Europe\/Berlin",
        "logtimezone": "Europe\/Berlin",
        "logtype": "file",
        "logfile": "\/mnt\/raid\/\/nextcloud\/nextcloud.log",
        "loglevel": 1,
        "allow_user_to_change_display_name": true,
        "upload_max_filesize": "100G",
        "mail_smtpsecure": "ssl",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "enable_previews": true,
        "preview_ffmpeg_path": "\/usr\/bin\/ffmpeg",
        "preview_concurrency_all": 4,
        "preview_concurrency_new": 2,
        "enabledPreviewProviders": [
            "OC\\Preview\\BMP",
            "OC\\Preview\\GIF",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\Image",
            "OC\\Preview\\PNG",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\MP3",
            "OC\\Preview\\PDF",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\SVG",
            "OC\\Preview\\ZIP",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Movie",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Krita",
            "OC\\Preview\\MOV",
            "OC\\Preview\\Imaginary"
        ],
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "preview_max_memory": 512,
        "preview_max_x": 1024,
        "preview_max_y": 1024,
        "dot_files": true,
        "theme": "",
        "music.lastfm_api_key": "***REMOVED SENSITIVE VALUE***",
        "music.lastfm_api_secret": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "camerarawpreviews",
            "workflow_media_converter"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR",
            "HTTP_X_REAL_IP"
        ],
        "push_server_url": "***REMOVED SENSITIVE VALUE***",
        "defaultapp": "dashboard,announcementcenter,calendar,files,spreed,mail,photos,music,notes,deck,passwords",
        "wopi_allowlist": [
            "***REMOVED SENSITIVE VALUE***"
        ]
    }
}

Apps

Enabled:

  • activity: 6.0.0
  • admin_audit: 1.23.0
  • announcementbanner: 2.4.2
  • announcementcenter: 7.4.1
  • app_api: 33.0.0
  • audiocoverpreview: 0.12.1
  • bruteforcesettings: 6.0.0
  • calendar: 6.5.0
  • camerarawpreviews: 1.1.1
  • circles: 33.0.0
  • cloud_federation_api: 1.17.0
  • comments: 1.23.0
  • contacts: 8.7.1
  • contactsinteraction: 1.14.1
  • dashboard: 7.13.0
  • dav: 1.36.0
  • deck: 1.17.4
  • end_to_end_encryption: 2.1.1
  • federatedfilesharing: 1.23.0
  • federation: 1.23.0
  • files: 2.5.0
  • files_autorename: 2.4.1
  • files_downloadlimit: 5.1.0
  • files_pdfviewer: 6.0.0
  • files_reminders: 1.6.0
  • files_retention: 4.0.1
  • files_sharing: 1.25.2
  • files_trashbin: 1.23.0
  • files_versions: 1.26.0
  • firstrunwizard: 6.0.0
  • imageconverter: 2.2.0
  • logcleaner: 1.5.5
  • logreader: 6.0.0
  • lookup_server_connector: 1.21.0
  • mail: 5.10.1
  • music: 3.1.0
  • nextcloud_announcements: 5.0.0
  • notes: 6.0.0
  • notifications: 6.0.0
  • notify_push: 1.3.3
  • oauth2: 1.21.0
  • password_policy: 5.0.0
  • photos: 6.0.0
  • previewgenerator: 5.13.0
  • privacy: 5.0.0
  • profile: 1.2.0
  • provisioning_api: 1.23.0
  • quota_warning: 1.24.0
  • recommendations: 6.0.0
  • related_resources: 4.0.0
  • richdocuments: 10.2.0
  • serverinfo: 5.0.0
  • settings: 1.16.0
  • sharebymail: 1.23.0
  • spreed: 23.0.6
  • support: 5.0.0
  • survey_client: 5.0.0
  • suspicious_login: 11.0.0
  • systemtags: 1.23.0
  • text: 7.0.1
  • theming: 2.8.0
  • twofactor_backupcodes: 1.22.0
  • twofactor_nextcloud_notification: 7.0.0
  • twofactor_totp: 15.0.0
  • updatenotification: 1.23.0
  • user_status: 1.13.0
  • viewer: 6.0.0
  • weather_status: 1.13.0
  • webhook_listeners: 1.5.0
  • workflow_media_converter: 3.0.1
  • workflowengine: 2.15.0
    Disabled:
  • encryption: 2.21.0 (installed 2.19.0)
  • files_external: 1.25.1
  • integration_google: 4.4.0 (installed 4.4.0)
  • user_ldap: 1.24.0

Tips for increasing the likelihood of a response

  • Use the preformatted text formatting option in the editor for all log entries and configuration output.
  • If screenshots are useful, feel free to include them.
    • If possible, also include key error output in text form so it can be searched for.
  • Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.

Can you try to ping 172.25.0.1?

chances exist the IP belongs to a docker proxy..

review your docker using

docker ls
docker inspect {container_name}
docker network ls
docker network inspect {network_name}

second command will tell you which networks the container is connected (and ip addresses in use).. last command will tell you which containers are connected to a respective network

When trying to ping 172.25.0.1 via the device Nextcloud is running on I am getting this:

PING 172.25.0.1 (172.25.0.1) 56(84) bytes of data.
From 62.214.42.39 icmp_seq=1 Destination Net Unreachable

When trying to ping this IP with another device (example my home PC) the same happens.

That’s the thing, I have already tested these. There is no docker container (or a bridge) with this IP. I now found out, that my member in the house has a Pi-Hole setup, could this maybe be a problem? (Nextcloud is reachable through a reverse proxy on NGINX)

this sounds like your router is trying to reach 172.25.0.1 which is wrong - rfc1918 addresses are non-routable in internet.

and how is the config of the reverse proxy especially the egress IP and what do you see in the proxy logs?