Hotfix Link Leads back to Blocked IP

Hello Jeff,

neither 120.245.64.189 nor 221.4.215.215 belongs to www.labs.greynoise.io at public DNS. If Serv-U would do a reverse DNS-lookup, it wouldn't get the complete URL (https://www.labs.greynoise.io/grimoire/2024-06-solarwinds-serv-u/), but only the domain (www.labs.greynoise.io), so this doesn't seem to be a reverse DNS-lookup. Where are these two lines from? Serv-U Log?
For me, it looks like the two urls are http-referer, but without background-info, where these two lines are from, it's only a blind shot.

best regards,
Markus

first off thanks... these are in the Domain Details IP tab, normally set to Allow or Deny

So, the moniker isn't correct, but here's the first one... before & after updating

After...


...the other after



Here are others that are normal, well expected from manually scanning logs (I hate the task but when I find suspects I block'm)

The bot work-around is an example of how the One Rule fails; IMHO there's a bug in the logic
If the rule is 4 attempts in 8 seconds, the user is allowed 6 attempts in 7 seconds, exceeding the 4 attempts, but within the 8 seconds; if anyone is asking Who would/could "try" to login more than 4 times in 8 seconds, ans. a Bot; SW should really allow more rules to effectively thwart BFA's