CSF deny list not blocking IPs with Imunify360 enabled

[ray]

Great product! Saves me tons of work no longer having to build my own list of miscreant IPs.

One problem:

IPs in the CSF deny list are not blocked when Imunify360 is enabled.

This IP is a WP login attack bot. Found tons of these entries on the Imunify Incidents page:

2 minutes ago United States 198.xxx.xxx.xxx 3 retries WordPress login attempt https://.com" rel="nofollow noreferr...w.<domain>.com

On the Imunify Blacklist page:

Black list management is disabled due to CSF integration mode.
Please use csf to manage black list.

So ...

csf -d 198.xxx.xxx.xxx
deny failed: 198.xxx.xxx.xxx is in already in the deny file /etc/csf/csf.deny 1 times

Yup, its there ...

# ipset --list chain_DENY | grep 198.*
198.xxx.xxx.xxx

Still getting this in the Imunify Incident log and in the website log file.

access-logs/<domain>.com:198.xxx.xxx.xxx - - [02/May/2017:14:52:22 -0400] "POST /wp-login.php HTTP/1.1" 200 1682 "-" "Mozilla/5.0

[bogdan.sh]

Hello. Thank you for report

Can you please submit this issue using our helpdesk system https://helpdesk.cloudlinux.com/ so that we can investigate it.

Please, provide our support team with output of `imunify360-agent doctor` command.

[bogdan.sh]

I just enabled my Imunify360, and I just noticed the same problem, my csf.deny stays empty with Imunify360 enabled.

[bogdan.sh]

> I just enabled my Imunify360, and I just noticed the same problem, my csf.deny stays empty with Imunify360 enabled.

This is a normal behavior. In CSF integration mode, all ip addresses blocked by lfd are going to Imunify360 graylist.