yeah thanks anyway but found it by myself doing this in the httpd.conf
this is just an example...
RewriteEngine On
RewriteCond %{QUERY_STRING} (query=2)
RewriteRule (.*) - [E=my_request:yes,F]
CustomLog "/var/log/httpd/httpd_filter.log" \
"%v %h %l %u %t \"%r\" %>s %b %I %O %P" env=my_request
so with this i can manually filter all URL Apache has to handle then send it in a log file if it match RewriteCond...
and so CSF watch this particular file to ban in iptables every single ip in this file.