ConfigServer Community Forum

Go to https://www.countryipblocks.net/search_ip.php and search there the country the IP belongs to.

It seems that the country database in your server has not updated the IPs and that is why it is showing "XX", write the IP here, if possible.

Sergio

oldblock,
check if port 587 is in your TCP/IN definition.

Sergio

As this forum is not for Mod_Security, I will send you a PM with the details.

Sergio

If you are using the payed rules, you have to be aware that some rules only work with ASL HARDENING, and the set of 70_asl_csrf_experimental.conf is one of them and is not needed with CSF, you can delete that set of rules. You can contact ASL support and they will confirm this.

Sergio

You can do this easily with mod_security, so, when someone writes anything that you don't like as a part of the URL mod_security can block the IP, then the IP will be block by CSF.

Sergio

add the process to csf.pignore

Sergio

I will suggest the other one:
http://configserver.com/cp/mailscanner.html
It is payed but, believe me, it is worth it.

Sergio

@screege,
then, DSHIELD is working on your firewall as well as SPAMDROP and SPAMEDROP.

Enter into ConfigServer Security&Firewall then to VIEW IPTABLE RULES then search for DSHIELD, that will show the iptable rules for dshield.

On the other hand, search in your /etc/csf if there is not the old configuration file.

Commenting the lines out mean enable them.

Check that DSHIELD line is as follows:
DSHIELD|86400|0|http://feeds.dshield.org/block.txt

That is what is working for me.