Customers office IP keeps getting blocked by CSF/ModSecurity? Cant figure out why

[Jordz2203]

Hi guys,
So one of our websites office keeps getting blocked by CSF/ModSecurity. Its weird, I keep having to go into Config Server Firewall as an admin and searching for the IP here

Then it gives me this
csf.deny: 154.IP.IP.21 # BFM: mod_security1=60 (ZA/South Africa/IPHostname) - Tue Sep 20 08:54:11 2022

I cant figure out why they keep getting blocked? Maybe the firewall is too strict, but I went into ModSecurity here

Then logs, but its too difficult to search them and I couldnt actually see any reason they getting blocked. Only one or two indiciating "suspicious activity" but none that confirmed a block.

 

[glio]

Do you set "ZA" block by country in csf??

 

[BillyS]

Isn't that reason stating Brute Force Monitor is calling for the block, not CSF block country? Have you checked the BFM logs to see what rule is being tripped? Did you try to white list the IPs?

 

[Jordz2203]

Isn't that reason stating Brute Force Monitor is calling for the block, not CSF block country? Have you checked the BFM logs to see what rule is being tripped? Did you try to white list the IPs?

I whitelisted the IP, I also ended up blocking the rule because it kept triggeting.

The rules were
Modsec 77316934 and Modesec 77140992

 

[BillyS]

So did that resolve the problem?

 

[Jordz2203]

So did that resolve the problem?

Yes, although I was hoping there mightve been a better way to resolve it, but Im happy with the fix thank you!