On a live server (Litespeed, at our ISP), running Drupal 7 (now latest; the message occurred with 7.62 if that’s relevant). A few of the more recent log messages for failed login attempts from anonymous users report 127.0.0.1 as the hostname, instead of the more typical outside IP.
I’m not sure if this is new behaviour; but it strikes me today as unusual — my understanding being that 127.0.0.1 is the loopback address that a local server itself uses.
Drupal logs and server logs look OK otherwise.
Any ideas about what this behaviour means?