❓ Security notifications: What does "@non_existing_user" mean in the message?

If you receive a security notification and the suffix "@non_existing_user" appears in the account name, this article explains what it means, how to interpret the IP address, and when action is actually required.

What does "@non_existing_user" mean?

The suffix @non_existing_user in the account name of a security notification means that the specified account does not exist on your FTAPI server. This means an attempt was made to log in with a username that does not exist in the system.

Such attempts are usually carried out by automated bots that try out common standard names without the attackers knowing your actual user accounts. Since the server is publicly accessible on the internet, this can happen at any time and cannot be completely prevented.

No action is required. The account does not exist, so a successful attack is impossible.

Why does the message say "The account has not been deactivated yet"?

This sentence is misleading in combination with @non_existing_user. Since the account does not exist, it can neither be deactivated nor locked. The wording is part of the general notification template and refers to cases where a real account is affected. In the case of @non_existing_user, it is not applicable.

What about the IP address in the message?

The notification shows the IP address from which the login attempts originated. In some cases, a private IP address appears (for example in the 10.x.x.x or 192.168.x.x range). This occurs when traffic is routed through a reverse proxy or a NAT gateway and the original external address is not passed on.

Blocking the displayed IP address is generally not useful, as automated attacks are often carried out with changing addresses from botnets.

Can I disable or customize these notifications?

Yes. In the Administration, you can disable the option Notification emails for brute force attacks on non-existing users. This way, you will no longer receive messages for accounts with the @non_existing_user suffix. Notifications for actually existing user accounts will continue to be sent.

Additionally, you can configure the threshold in the Administration at which a notification is triggered. The message appears as soon as the defined number of unsuccessful login attempts is reached.

When is a message really suspicious?

A message should be taken seriously if the account name does not contain the @non_existing_user suffix and you can find the mentioned account in your user management. In this case, someone has tried to log in with a real, existing account. Reset the password of the affected account and activate two-factor authentication for this user or the associated group. If in doubt, contact FTAPI Support.