Log-In attempts seen in the logs - is this malicious vs Config issues?

I got my RPi3 back up and running after a few weeks due to SD card issues.
Now I’m getting notifications in the logs saying “Login attempt or request with invalid authentication from”.
I’m not network savy.
However, I tried to do a IP look-up, and the WHOIS IP lookup tools says:
Source: whois.arin.net
IP Address:
Handle: NET-172-16-0-0-1
Registration Date: 3/15/94
Org: Internet Assigned Numbers Authority
Org Handle: IANA
Address: 12025 Waterfront Drive
Suite 300
City: Los Angeles
State/Province: CA
Postal Code: 90292
Country: United States

Does this appear to be a malicious player, or a web crawler who found my internet instance because I have a 443 to 443 forwarded port to use the DuckDNS for remote access? There have been multiple instances from that IP address attempting to log on per the log.
I don’t recall ever having this issue previously.
I am password protected.
Should I try to block this IP address at the router level?
I see the physical address above in LA is the same building as ICANN.
Other forum posts have similar issues with invalid login from
It was thought perhaps NGINX (which I am using) and DuckDNS perhaps caused this.
Any guidance is appreciated.
Thanks for your help

More searching on the forums shows that the is the docker IP address.
So the question is why am I getting this error? Any ideas how to prevent it?

Real quick test, disable 443/8123 port forward and see if the logins continue, that should help put your mind at rest a little bit that its not something outside trying to login.

I’m afraid i don’t know enough about docker and it’s networking to advise any further than that.

1 Like

Those IP addresses are the docker container. Just ignore them.