A work partner that usually navigates on the website frontend has been blocked by AT, with the message "You're a bad person" etc...
I am, of course, sure that no dangerous behavior has been done by this user.
Checking the blocked request log, I've seen his IP blocked for the reason "suspicious core parameter". The URL is a non-sef address, this:Β https://www.lalineascritta.it/component/search/?layout=j51_jasmine:alternative&id=101&Itemid=592&format=opensearch
That is very strange, since the site has only SEF URL's, and he navigates regularly going from homepage to other pages using menus, and did not use the search component.
I unblock and put in whitelist his IP when the problem occurs, but the issue keeps repeating apparently every time he changes IP (that it is not permanent=.
Can you please help?
Thanks
Marco