(mod_security) mod_security (id:5000222) triggered by 179.108.72.156 (BR/Brazil/-): 5 in the last 3600 secs (CF_ENABLE) - *Blocked in csf* for 3600 secs [LF_MODSEC]
lfd[1172013]: Incoming IP 179.108.72.156 temporary block removed
lfd[1172013]: Outgoing IP 179.108.72.156 temporary block removed
lfd[1172016]: CloudFlare: [179.108.72.156] [CloudFlare: [179.108.72.156] block failed: 400 Bad Request] remove failed: 400 Bad Request (any)
Cloudflare support says the following:
Thank you for contacting Cloudflare Support.
The firewall log entry you're seeing indicates an issue with the API request to Cloudflare's firewall. The error message "400 Bad Request" suggests that the request from CSF to Cloudflare's API was not properly formatted or contained invalid data.
This could be due to a problem with the API token permissions, but it's also possible that the issue lies with the request itself.
I've eliminated API token permissions, so this leaves only "the request from CSF to Cloudflare's API was not properly formatted or contained invalid data."