ConfigServer Community Forum

What are you looking for the REGEX to do with that info?

Sergio

Please post a blocked note to see what is wrong.

Sergio

Does a "pignore" will help you on this?

Sergio

Here is the new rule: # BLOCKING ModSec Rules attacks if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[\S+:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(210280|210350|210380|210481|210492|210710|210730|210831|210921)"\...

Post a log line of your ModSecurity error_log for me to check it, thanks.

Sergio

Testing your sample log at regex101 the rule is working as should be and shows:

GROUP1 144-165 someaddress@gmail.com
GROUP2 170-181 12.34.56.78

Could it be that the IP is in a white list?

Sergio

Yes, is possible if your email is in your cpanel, you can create a filter to delete that email when it is your own IP that logged in.
Sergio

Yes, you can add the IP to the white list.

If those users have dedicated IPs then you can WhiteList those IPs.
Remember that CSF is a FireWall based on IPs, so to white list them you have to white list the IPs.

You have to check a few things. - Does cPhulk is running in your server? If yes, then check if the IP is not being block by cPhulk. If it is, then add your IP on the whitelist in cPhulk. - Have you tried to add your IP on /etc/csf/csf.ignore ? If not then, do what the readme on file suggest: # The f...

Try checking /var/log/maillog