Nextcloud version: 20.0.7
Operating system and version: Debian GNU/Linux 10 (buster)
Apache or nginx version: Apache/2.4.38 (Debian)
PHP version: 7.3.27
The issue you are facing:
Login attempts to random decimal number usernames being made from multiple IP addresses.
Mostly wondering if anyone has seen anything like this, is this cause for concern?
Seems to have repeated on January 4th and February 4th.
Are there valid logins from this ip as well? Perhaps some user with a client where a client is doing strange things.
Hi thank you for your reply,
This is a personal deployment running at home, mostly for testing purposes. There really only is one active account (my own). I received requests like this on the January 4th and February 4th from a large variety of IP addresses, if not for the very strange entries into the user field I would call it a bruteforcing attempt.
These IPs belong to cloudflare. You are not using cloudfare by chance?
