ConfigServer Community Forum

As the email is pure informative it means that you don't do have to do anything more than check why dovecot is reporting this. So, you don't need to add any rule into pignore as it is been ignored by the OS. Checking on the anvil process: is responsible for tracking authentication penalties for diff...

If you provide a complete log line where that info appears, a regex can be done.

Sergio

Or you can add that IP into cPHulk Black List.

Sergio

Have you tried to add the following line into CSF.PIGNORE?
exe: /opt/cpanel/ea-php81/root/usr/sbin/php-fpm

Sergio

What are you looking for the REGEX to do with that info?

Sergio

Please post a blocked note to see what is wrong.

Sergio

Does a "pignore" will help you on this?

Sergio

Here is the new rule: # BLOCKING ModSec Rules attacks if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[\S+:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(210280|210350|210380|210481|210492|210710|210730|210831|210921)"\...

Post a log line of your ModSecurity error_log for me to check it, thanks.

Sergio

Testing your sample log at regex101 the rule is working as should be and shows:

GROUP1 144-165 someaddress@gmail.com
GROUP2 170-181 12.34.56.78

Could it be that the IP is in a white list?

Sergio