Weird, hours later it started showing the lockout attempts I made, but the IP address is that of our internal docker container.
That would mean any attempt will appear to come from that IP address. I assume this is something to do with removing the “reverse proxy” option?
Also, if the “admin” username is added to the blacklist like I have done, does this mean it no longer is shown in the attempted login table?