We had in the last time a few incorrect login attempts with username: a, in this case, Moodle reports this to the Moodle admin mail. Now my problem is that I don't know from which source the problem is coming from. Once I contacted a person and then the person said that he was only using the Win10 Moodle app., is there somebody else with the same behavior?
The login attempts are in a short-time period from the same source-ip...
It could very well be the Moodle Mobile, which doesn't have the right password.
To prove, either you can ask the person to uninstall the Win 10 Mobile Mobile app or you can install Moodle Mobile on a mobile device, run it for some time and change the password of the user from another machine (or as admin).
I've just run the Moodle Desktop App. in my Win10 VM (VirtualBox) and found out that when I connect to our Moodle site, it redirects us to the /login/index.php and it directly generates an "Site error" with:
|System |||System |||User login failed |||Login failed for user 'a'. User does not exist (error ID '1').|
We're after authenticating with a Shibboleth implementation and it works well and generates the token. Also closing the app and launch it again, automatically logs me into the dashboard of our Moodle site. After that, I logged out and I was redirected to the /login/index.php site. Then I stay longer on this login page, and with the ajax post requests it generates several identical failures, but additionally this time an error is appearing:
|System |||System |||Web service login failed |||Web service authentication failed with code: "invalid_token".|
Now I'm on the Moodle Desktop Websites Overview, where I see my added Moodle site and doing nothing and it still generates these errors.
I think there must be a huge bug. Hope somebody can help to debug it...
sorry for the delay in answering.
Those fake credentials are sent by the app to avoid some CORS issues while testing the app in a browser. They aren't sent in Mobile apps (Android/iOS), and they probably shouldn't be sent in desktop apps either, but right now they are due to a bug in the app. I opened an issue to fix this: