Hi,
I recently added Abuse IP DB to my CSF blocklists file as I've seen an increase in web scanning, and all of the source IPs were listed on AbuseIPDB, so I figured it may be a good source to add to CSF blocklists..
I noticed some unwanted traffic this morning, and the IP was on AbuseIPDB, so I started digging and found that the csf.block.abuseipdb file in /var/lib/csf only contains around 2800 entries, whereas the source file from AbuseIPDB contains 10,000 entries.
The IP that caused the traffic this morning was in the source list, but was around entry 8,000 hence it was missing and wasn't blocked..
Any ideas what could be causing this please?
Thanks