Regex problem using one of the pre-defined lsws ones

[webwalrus]

I'm using this rule I pulled from the forum:

# BLOCKING LiteSpeed attacks by Sergio

if (($lgfile eq $config{CUSTOM4_LOG}) and ($line =~ /^\S+\s+\S+\s\[NOTICE\].*Failed Login Attempt \- username: (\S+) ip: (\S+)/i)) {
return ("$1",$2,"SECMAS_LiteSpeed","1","1");
}

on my cPanel/Linux box. In CSF.conf, I have

CUSTOM4_LOG = "/usr/local/lsws/admin/logs/error.log"

and a sample log line is

2024-09-09 11:44:59.892860 [NOTICE] [27145] [T0] [12.34.56.78:51468-1#_AdminVHost] [STDERR] [WebAdmin Console] Failed Login Attempt - username: someaddress@gmail.com ip: 12.34.56.78 url: https://ftp.myclientdomain.com:7080/login.php\n

If I put the sample log line in a regex tester, the pattern matches just fine. But it's not blocking. I've restarted both CSF and LFD. Any idea what could be going on? This endpoint is getting hit hundreds of times every 15 minutes, with the IP changing slightly every couple of hours.

Any thoughts as to what might be going on?

[Sergio]

Testing your sample log at regex101 the rule is working as should be and shows:

GROUP1 144-165 someaddress@gmail.com
GROUP2 170-181 12.34.56.78

Could it be that the IP is in a white list?

Sergio