In most of the cases the CSF will block external IP addresses due to the result any Brute force attack or something like that(Multiple login failure, hacking attepts etc) on server. We can find out all details regarding the IP block from the ‘lfd’ log. The reason for IP block, exact time etc will be explained in the log file. CSF log file details: All records related with the CSF and LFD is loged in a file under “/var/log“. The log file for CSF&LFD is: " /var/log/lfd.log "