Weird access log in my Nextcloud instance! should I be worried?

So yesterday I set up a Nextcloud server hosted on my raspberryPI (in my home), I set up everything correctly , set up HTTPS, and followed the security hardening guide.
but since then , I have been getting weird behaviors in my server’s access.log file ?

I am not talking about usual internet noise such bots auto scanning for vulnerabilities that usually don’t return 200.

here is an example about what I am getting
and none of these IPs is mine or some friend’s IP , it’s not even from the same country.
is this someone accessing my Nextcloud login page or something?
is This normal? or should I be worried?

70.42.131.189 - - [30/Apr/2020:06:09:19 +0000] "GET / HTTP/1.1" 302 -
70.42.131.189 - - [30/Apr/2020:06:09:20 +0000] "GET /index.php/login HTTP/1.1" 200 11674
70.42.131.189 - - [30/Apr/2020:06:09:21 +0000] "GET /apps/files_pdfviewer/css/style.css?v=6a154fe0-40 HTTP/1.1" 200 346
70.42.131.189 - - [30/Apr/2020:06:09:21 +0000] "GET /core/css/guest.css?v=42497c32-40 HTTP/1.1" 200 20949
70.42.131.189 - - [30/Apr/2020:06:09:21 +0000] "GET /index.php/apps/theming/styles?v=40 HTTP/1.1" 200 1482
70.42.131.189 - - [30/Apr/2020:06:09:22 +0000] "GET /index.php/js/core/merged-template-prepend.js?v=42497c32-40 HTTP/1.1" 200 2950
70.42.131.189 - - [30/Apr/2020:06:09:23 +0000] "GET /core/search/js/search.js?v=42497c32-40 HTTP/1.1" 200 5560
70.42.131.189 - - [30/Apr/2020:06:09:23 +0000] "GET /core/js/backgroundjobs.js?v=42497c32-40 HTTP/1.1" 200 917
70.42.131.189 - - [30/Apr/2020:06:09:23 +0000] "GET /apps/files_pdfviewer/js/previewplugin.js?v=42497c32-40 HTTP/1.1" 200 6000
70.42.131.189 - - [30/Apr/2020:06:09:23 +0000] "GET /apps/files_sharing/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 2043
70.42.131.189 - - [30/Apr/2020:06:09:23 +0000] "GET /index.php/apps/theming/image/background?v=40 HTTP/1.1" 200 45614
70.42.131.189 - - [30/Apr/2020:06:09:24 +0000] "GET /index.php/svg/core/logo/logo?color=fff&v=1 HTTP/1.1" 200 321
70.42.131.189 - - [30/Apr/2020:06:09:24 +0000] "GET /apps/files_videoplayer/js/main.js?v=42497c32-40 HTTP/1.1" 200 6350
70.42.131.189 - - [30/Apr/2020:06:09:24 +0000] "GET /core/search/js/searchprovider.js?v=42497c32-40 HTTP/1.1" 200 12444
70.42.131.189 - - [30/Apr/2020:06:09:24 +0000] "GET /core/js/files/fileinfo.js?v=42497c32-40 HTTP/1.1" 200 2142
70.42.131.189 - - [30/Apr/2020:06:09:25 +0000] "GET /core/js/files/client.js?v=42497c32-40 HTTP/1.1" 200 23878
70.42.131.189 - - [30/Apr/2020:06:09:29 +0000] "GET /index.php/apps/theming/js/theming?v=40 HTTP/1.1" 200 225
70.42.131.189 - - [30/Apr/2020:06:09:29 +0000] "GET /index.php/apps/accessibility/js/accessibility?v=0 HTTP/1.1" 200 85
70.42.131.189 - - [30/Apr/2020:06:09:22 +0000] "GET /core/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 1364972
70.42.131.189 - - [30/Apr/2020:06:09:25 +0000] "GET /core/js/dist/login.js?v=42497c32-40 HTTP/1.1" 200 747069

65.154.226.109 - - [30/Apr/2020:06:49:02 +0000] "GET / HTTP/1.1" 302 -
65.154.226.109 - - [30/Apr/2020:06:49:03 +0000] "GET /index.php/login HTTP/1.1" 200 11674
65.154.226.109 - - [30/Apr/2020:06:49:04 +0000] "GET /apps/files_pdfviewer/css/style.css?v=6a154fe0-40 HTTP/1.1" 200 346
65.154.226.109 - - [30/Apr/2020:06:49:04 +0000] "GET /core/css/guest.css?v=42497c32-40 HTTP/1.1" 200 20949
65.154.226.109 - - [30/Apr/2020:06:49:04 +0000] "GET /index.php/apps/theming/styles?v=40 HTTP/1.1" 200 1482
65.154.226.109 - - [30/Apr/2020:06:49:04 +0000] "GET /index.php/js/core/merged-template-prepend.js?v=42497c32-40 HTTP/1.1" 200 2950
65.154.226.109 - - [30/Apr/2020:06:49:05 +0000] "GET /core/search/js/search.js?v=42497c32-40 HTTP/1.1" 200 5560
65.154.226.109 - - [30/Apr/2020:06:49:06 +0000] "GET /core/js/backgroundjobs.js?v=42497c32-40 HTTP/1.1" 200 917
65.154.226.109 - - [30/Apr/2020:06:49:06 +0000] "GET /apps/files_sharing/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 2043
65.154.226.109 - - [30/Apr/2020:06:49:06 +0000] "GET /apps/files_pdfviewer/js/previewplugin.js?v=42497c32-40 HTTP/1.1" 200 6000
65.154.226.109 - - [30/Apr/2020:06:49:06 +0000] "GET /index.php/apps/theming/image/background?v=40 HTTP/1.1" 200 45614
65.154.226.109 - - [30/Apr/2020:06:49:07 +0000] "GET /apps/files_videoplayer/js/main.js?v=42497c32-40 HTTP/1.1" 200 6350
65.154.226.109 - - [30/Apr/2020:06:49:07 +0000] "GET /index.php/svg/core/logo/logo?color=fff&v=1 HTTP/1.1" 200 321
65.154.226.109 - - [30/Apr/2020:06:49:09 +0000] "GET /core/js/files/fileinfo.js?v=42497c32-40 HTTP/1.1" 200 2142
65.154.226.109 - - [30/Apr/2020:06:49:09 +0000] "GET /core/js/files/client.js?v=42497c32-40 HTTP/1.1" 200 23878
65.154.226.109 - - [30/Apr/2020:06:49:09 +0000] "GET /core/search/js/searchprovider.js?v=42497c32-40 HTTP/1.1" 200 12444
65.154.226.109 - - [30/Apr/2020:06:49:14 +0000] "GET /index.php/apps/theming/js/theming?v=40 HTTP/1.1" 200 225
65.154.226.109 - - [30/Apr/2020:06:49:15 +0000] "GET /index.php/apps/accessibility/js/accessibility?v=0 HTTP/1.1" 200 85
65.154.226.109 - - [30/Apr/2020:06:49:10 +0000] "GET /core/js/dist/login.js?v=42497c32-40 HTTP/1.1" 200 747069
65.154.226.109 - - [30/Apr/2020:06:49:04 +0000] "GET /core/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 1364972

65.155.30.101 - - [30/Apr/2020:06:50:34 +0000] "GET /index.php/login HTTP/1.1" 200 11684
65.155.30.101 - - [30/Apr/2020:06:50:35 +0000] "GET /apps/files_pdfviewer/css/style.css?v=6a154fe0-40 HTTP/1.1" 200 346
65.155.30.101 - - [30/Apr/2020:06:50:35 +0000] "GET /core/css/guest.css?v=42497c32-40 HTTP/1.1" 200 20949
65.155.30.101 - - [30/Apr/2020:06:50:36 +0000] "GET /core/img/background.png?v=2 HTTP/1.1" 200 35361
65.155.30.101 - - [30/Apr/2020:06:50:36 +0000] "GET /index.php/js/core/merged-template-prepend.js?v=42497c32-40 HTTP/1.1" 200 2950
65.155.30.101 - - [30/Apr/2020:06:50:36 +0000] "GET /core/img/logo/logo.svg?v=1 HTTP/1.1" 200 321
65.155.30.101 - - [30/Apr/2020:06:50:35 +0000] "GET /index.php/apps/theming/styles?v=40 HTTP/1.1" 200 1482
65.155.30.101 - - [30/Apr/2020:06:50:39 +0000] "GET /core/search/js/search.js?v=42497c32-40 HTTP/1.1" 200 5560
65.155.30.101 - - [30/Apr/2020:06:50:40 +0000] "GET /core/js/backgroundjobs.js?v=42497c32-40 HTTP/1.1" 200 917
65.155.30.101 - - [30/Apr/2020:06:50:40 +0000] "GET /apps/files_sharing/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 2043
65.155.30.101 - - [30/Apr/2020:06:50:41 +0000] "GET /apps/files_pdfviewer/js/previewplugin.js?v=42497c32-40 HTTP/1.1" 200 6000
65.155.30.101 - - [30/Apr/2020:06:50:41 +0000] "GET /apps/files_videoplayer/js/main.js?v=42497c32-40 HTTP/1.1" 200 6350
65.155.30.101 - - [30/Apr/2020:06:50:42 +0000] "GET /core/search/js/searchprovider.js?v=42497c32-40 HTTP/1.1" 200 12444
65.155.30.101 - - [30/Apr/2020:06:50:42 +0000] "GET /core/js/files/fileinfo.js?v=42497c32-40 HTTP/1.1" 200 2142
65.155.30.101 - - [30/Apr/2020:06:50:43 +0000] "GET /core/js/files/client.js?v=42497c32-40 HTTP/1.1" 200 23878
65.155.30.101 - - [30/Apr/2020:06:50:46 +0000] "GET /index.php/apps/theming/js/theming?v=40 HTTP/1.1" 200 225
65.155.30.101 - - [30/Apr/2020:06:50:47 +0000] "GET /index.php/apps/accessibility/js/accessibility?v=0 HTTP/1.1" 200 85
65.155.30.101 - - [30/Apr/2020:06:50:47 +0000] "GET /index.php/apps/theming/image/background?v=40 HTTP/1.1" 200 45614
65.155.30.101 - - [30/Apr/2020:06:50:48 +0000] "GET /index.php/svg/core/logo/logo?color=fff&v=1 HTTP/1.1" 200 321

65.154.226.109 - - [30/Apr/2020:06:50:50 +0000] "GET / HTTP/1.1" 301 239
65.154.226.109 - - [30/Apr/2020:06:50:51 +0000] "GET / HTTP/1.1" 302 -
65.154.226.109 - - [30/Apr/2020:06:50:52 +0000] "GET /index.php/login HTTP/1.1" 200 11684
65.154.226.109 - - [30/Apr/2020:06:50:53 +0000] "GET /core/css/guest.css?v=42497c32-40 HTTP/1.1" 200 20949
65.154.226.109 - - [30/Apr/2020:06:50:53 +0000] "GET /apps/files_pdfviewer/css/style.css?v=6a154fe0-40 HTTP/1.1" 200 346
65.154.226.109 - - [30/Apr/2020:06:50:54 +0000] "GET /index.php/apps/theming/styles?v=40 HTTP/1.1" 200 1482
65.154.226.109 - - [30/Apr/2020:06:50:54 +0000] "GET /index.php/js/core/merged-template-prepend.js?v=42497c32-40 HTTP/1.1" 200 2950
65.154.226.109 - - [30/Apr/2020:06:50:56 +0000] "GET /core/search/js/search.js?v=42497c32-40 HTTP/1.1" 200 5560
65.154.226.109 - - [30/Apr/2020:06:50:56 +0000] "GET /core/js/backgroundjobs.js?v=42497c32-40 HTTP/1.1" 200 917
65.154.226.109 - - [30/Apr/2020:06:50:58 +0000] "GET /core/img/background.png?v=2 HTTP/1.1" 200 35361
65.154.226.109 - - [30/Apr/2020:06:50:58 +0000] "GET /core/img/logo/logo.svg?v=1 HTTP/1.1" 200 321
65.154.226.109 - - [30/Apr/2020:06:50:58 +0000] "GET /apps/files_sharing/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 2043
65.154.226.109 - - [30/Apr/2020:06:50:58 +0000] "GET /apps/files_pdfviewer/js/previewplugin.js?v=42497c32-40 HTTP/1.1" 200 6000
65.154.226.109 - - [30/Apr/2020:06:50:59 +0000] "GET /apps/files_videoplayer/js/main.js?v=42497c32-40 HTTP/1.1" 200 6350
65.154.226.109 - - [30/Apr/2020:06:51:00 +0000] "GET /core/search/js/searchprovider.js?v=42497c32-40 HTTP/1.1" 200 12444
65.154.226.109 - - [30/Apr/2020:06:51:01 +0000] "GET /core/js/files/fileinfo.js?v=42497c32-40 HTTP/1.1" 200 2142
65.154.226.109 - - [30/Apr/2020:06:51:01 +0000] "GET /core/js/files/client.js?v=42497c32-40 HTTP/1.1" 200 23878
65.154.226.109 - - [30/Apr/2020:06:51:05 +0000] "GET /index.php/apps/theming/js/theming?v=40 HTTP/1.1" 200 225
65.154.226.109 - - [30/Apr/2020:06:51:06 +0000] "GET /index.php/apps/accessibility/js/accessibility?v=0 HTTP/1.1" 200 85
65.154.226.109 - - [30/Apr/2020:06:51:07 +0000] "GET /index.php/apps/theming/image/background?v=40 HTTP/1.1" 200 45614
65.154.226.109 - - [30/Apr/2020:06:51:08 +0000] "GET /index.php/svg/core/logo/logo?color=fff&v=1 HTTP/1.1" 200 321
65.154.226.109 - - [30/Apr/2020:06:51:02 +0000] "GET /core/js/dist/login.js?v=42497c32-40 HTTP/1.1" 200 747069
65.154.226.109 - - [30/Apr/2020:06:50:54 +0000] "GET /core/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 1364972


65.155.30.101 - - [30/Apr/2020:06:50:44 +0000] "GET /core/js/dist/login.js?v=42497c32-40 HTTP/1.1" 200 747069
65.155.30.101 - - [30/Apr/2020:06:50:36 +0000] "GET /core/js/dist/main.js?v=42497c32-40 HTTP/1.1" 200 1364972
65.155.30.101 - - [30/Apr/2020:06:52:24 +0000] "GET /core/img/actions/confirm-white.svg?v=2 HTTP/1.1" 200 405
65.155.30.101 - - [30/Apr/2020:06:52:24 +0000] "GET /core/img/loading-dark.gif HTTP/1.1" 200 4683
65.155.30.101 - - [30/Apr/2020:06:52:24 +0000] "GET /core/img/actions/toggle.svg HTTP/1.1" 200 308
65.155.30.101 - - [30/Apr/2020:06:52:24 +0000] "GET /cron.php HTTP/1.1" 200 20

Hello @issyrona,

welcome to the user forums!

As soon as you hook up a system to the internet the crawlers are coming …

Hi @issyrona

Did you ever figure out what was going on? I recently just started my NextCloud server and I got the same log entries you got. Actually from the same IPs as well. Not sure how they were able to access the server without knowing the domain name of my server.

You will also get people that run scripts looking for vulnerabilities on your site and server.

They will access randomly by IP, scanning whatever they find. This is why I require SNI on my setup. Serve a dummy site or redirect as your default site. That way many crawlers won’t even find your Nextcloud server.