I use Cloudflare, and I have the Cloudflare plugin to return the visitor's original IP address. Defender is blocking Cloudflare addresses instead of the originating IP. However, most addresses in the logs are correctly returning the correct IP.
The addresses blocked are:
Defender has not blocked any other IP addresses.
I've searched the forum to see if this is a known issue. The nearest thing I can see is the unresolved ticket WHEN USING CLOUDFLARE DEFENDER DOES NOT RECOGNIZE THE TRUE IP ADDRESS. But that refers to all IP addresses, not just Lockouts.
Until this is resolved, I realize I can whitelist Cloudflare, but that raises 2 more problems:
1. It doesn't tell me what the bad IP address is. Because I like to restrict persistently bad ISPs in Cloudflare so all my websites are protected.
2. The Cloudflare list at https://www.cloudflare.com/ips/ is in CIDR format and I've forgotten how to convert it to your format. Do you have a similar list in xxx-xxx format?