I have just installed www/mod_evasive and received its first report that it had blacklisted an IP address, so I checked the access log to see what that address had been up to, but it's not there. This puzzles me, I thought this only happened if it asked for too much too quickly, but then wouldn't the access attempts be listed until it was blacklisted? Why would it blacklist an address which hadn't accessed the server?
I'm puzzled.
I'm puzzled.