Support

Normally I'd ask you to check the Blocked Requests Log to see what is the Target URL and Reason for each person being blocked. This will tell you why these people are being blocked.

However, I can make an educated guess. You said your site was based on WordPress and the way you worded your request makes me think that people need to log into your site to read the news. In this case it's very likely they had bookmarked the login page of WordPress. However, the 404Shield of the Web Application Firewall in Admin Tools, if enabled, would treat the WordPress login URL and the WordPress administration URLs as blocked requests. If these people tried to access such a URL repeatedly they'd get their IP blocked.

Go to Component, Admin Tools, Web Application Firewall, Configure WAF, Cloaking and set “404 Shield” to No. Click on Save & Close.

If my educated guess was right this will fix the problem you have. Otherwise check the Blocked Requests Log and tell me what is the Reason and Target URL for the people who get blocked.

which opens up if I put the subdomain where the old site is infront of the url. But if I put the main domain it blocks it.

First things first. The subdomain is running WordPress. It has the image file you are looking for. Therefore it serves the image. The main site runs Joomla. It does not have the image you are looking for. All missing files are handled by Joomla's index.php file (that's how SEF URLs work; any "missing" file is handled by Joomla). However, Joomla doesn't know what to do with this URL either. Therefore it throws a 404 error. 

Since you have enabled the 404Shield in Admin Tools configuration (as I explained before) it kicks in. Now, look at the default configuration of this feature:

wp-admin.php
wp-login.php
wp-content/*
wp-admin/*

Your image URL matches the third pattern: wp-content/ followed by anything else (that's what the star stands for). Therefore it is treated as a Blocked Request.

Since you can't make the old image URLs magically disappear your best course of action is to go to Components, Admin Tools, Web Application Firewall, Configure WAF, Cloaking tab and set “Enable 404Shield” to No.

The reason is that your site used to be a WordPress site and you will most definitely get traffic from old URLs which would be caught by the 404Shield feature. The 404Shield feature is designed for Joomla sites on domains which never had any WordPress site on them before, meaning that any WordPress URLs would be a tell-tale sign of someone trying to do something shady. This is NOT the case with your site; your site is the exact opposite. Therefore you should turn this feature off.