🐛 Bug: CSF_MASTER includes SemRush IP incorrectly

[jdimea]

CSF › Version

15

CSF › Release

Stable

System › OS

Linux

System › Distro & Version

AlmaLinux release 8.10

Control Panel › Name

cPanel

Priority

Normal

Issue Description

CSF_MASTER is blocking some SemRush IPs it seems incorrectly:

• 85.208.98.192
• 85.208.98.193
• 85.208.98.194
• 85.208.98.195
• 85.208.98.196
• 85.208.98.197
• 85.208.98.198
• 85.208.98.199

Checking these IPs on abuseipdb.com shows "Confidence of Abuse is 0%" along with the following note:
Important Note: 85.208.98.194 is an IP address from within our benign crawler whitelist. We confidently believe it is not a bad bot. If you disagree, please provide us with compelling evidence.

They also do not appear to be blocked in the other lists that CSF_MASTER uses.

Is this blocklist incorrectly adding these IPs to the IPSET list when they are labeled as whitelisted or 0% confidence?

Steps To Reproduce

N/A

Logs › Lfd

No response

Config › csf.conf

No response

Screenshots

No response

[Aetherinox]

AbuseIPDB is one of the sources for that list, along with a few others that have a pretty high confidence in it being either a bot, spam, or something that has caused that IP to have a history in the recent past.

Let me go look through and see which blocklist is adding the IP, and do some searches on the IP to see "why".

There's a new version of these blocklists which is coming out any time now, which allows you to be able to have control over the lists themselves, and you can exclude blocks if IPs if you don't want them in the list.

I'm actually working on it now.

But let me investigate that list and see which one is responsible.

[Aetherinox]

So it is indeed coming from AbuseIPDB. But the odd thing is that the backend is reporting that it has had reports and put the confidence higher. But the front in search puts it at 0%, which is.... odd.

I'm going to go dig around some and see if I can find out why.

I think what I'm going to do, before I release the new API, is split Abuse up into its own category / file. Just to segregate it from the others since AbuseIPDB seems to be the one people are after the most.

Coupled with the fact that once this new version releases, lists are going to be updated significantly more often. I'm just setting up the new repo now.