--- title: "❓ Security notifications: What does \"@non_existing_user\" mean in the message?" url: "https://support.ftapi.com/en/article/-sicherheitsbenachrichtigungen-was-bedeutet-non-existing-user-in-der-meldung" language: "en" last_updated: "2026-11-12T11:04:15.243Z" --- # ❓ Security notifications: What does "@non_existing_user" mean in the message? This article explains what the automatic security notification for a brute force attack means, how to interpret the "@non_existing_user" suffix and the IP address shown, and what to do if an existing user account is actually affected. ## What does "@non\_existing\_user" mean? The suffix `@non_existing_user` in the account name of a security notification means that the specified account does not exist on your FTAPI server. This means an attempt was made to log in with a username that does not exist in the system. Such attempts are usually carried out by automated bots that try out common standard names without the attackers knowing your actual user accounts. Since the server is publicly accessible on the internet, this can happen at any time and cannot be completely prevented. **No action is required.** The account does not exist, so a successful attack is impossible. ## Why does the message say "The account has not been deactivated yet"? This sentence is misleading in combination with `@non_existing_user`. Since the account does not exist, it can neither be deactivated nor locked. The wording is part of the general notification template and refers to cases where a real account is affected. In the case of `@non_existing_user`, it does not apply. ## What about the IP address in the message? The notification shows the IP address from which the login attempts originated. In some cases, a private IP address appears, for example in the 10.x.x.x or 192.168.x.x range. This occurs when traffic is routed through a reverse proxy or a NAT gateway and the original external address is not passed on. Blocking the displayed IP address or general geoblocking, i.e. blocking entire countries or regions, is usually not useful. Automated attacks are often carried out with changing addresses from botnets. A fixed IP block would have to be set up again every time the address changes, without stopping the actual attack. ## Can I disable or customize these notifications? Yes. In the `Administration`, you can disable the option **Notification emails for brute force attacks on non-existing users**. This way, you will no longer receive messages for accounts with the `@non_existing_user` suffix. Notifications for actually existing user accounts will continue to be sent. Additionally, you can configure the threshold in the `Administration` at which a notification is triggered. The message appears as soon as the defined number of unsuccessful login attempts is reached. A complete overview of all brute force protection settings can be found in the article [System: Configuring Brute-Force Protection](https://support.ftapi.com/en/article/-brute-force-protection). ## When is a message really suspicious? A message should be taken seriously if the account name does not contain the `@non_existing_user` suffix and you can find the mentioned account in your `User management`. In this case, someone has tried to log in with a real, existing account. > **Note:** If your instance uses SSO (Single Sign-On), authentication is controlled via your Identity Provider. Login attempts via the direct FTAPI login can still occur and trigger notifications. ## What should I do if my user account is actually affected? 1. Check whether the account has been locked automatically by the brute force protection. If the option `Lock affected account` is enabled, the platform locks the account automatically as soon as the defined number of failed attempts is reached. 2. Reset the password of the affected account. 3. Activate two-factor authentication for this user or the associated group. 4. Before assuming an attack, also check simple causes, for example an outdated password saved in the browser that fails automatically with every login. 5. If in doubt, contact FTAPI Support. How to unlock an account that was locked by the brute force protection is described in the article [Unlocking users in the FTAPI platform](https://support.ftapi.com/en/article/-benutzer-entsperren-in-der-ftapi-plattform), case B. > **Note:** Several messages on the same day for the same account do not necessarily mean several different attackers. Each failed login attempt is logged separately and can trigger its own notification. ## Related articles > [**📋 System: Configuring Brute-Force Protection**](https://support.ftapi.com/en/article/-brute-force-protection) > [**📋 Unlocking users in the FTAPI platform**](https://support.ftapi.com/en/article/-benutzer-entsperren-in-der-ftapi-plattform)