# LePresidente/http-generic-401-bf -\> false positive & where does this role come from?
**URL:** https://discourse.crowdsec.net/t/lepresidente-http-generic-401-bf-false-positive-where-does-this-role-come-from/1000
**Category:** Uncategorized
**Created:** [October 31, 2022, 12:18pm UTC](https://discourse.crowdsec.net/t/lepresidente-http-generic-401-bf-false-positive-where-does-this-role-come-from/1000 "2022-10-31T12:18:44Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@blu-IT](https://discourse.crowdsec.net/u/blu-IT)
#### Post date: [October 31, 2022, 12:18pm UTC](https://discourse.crowdsec.net/t/lepresidente-http-generic-401-bf-false-positive-where-does-this-role-come-from/1000/1 "2022-10-31T12:18:44Z")
Hello,
we had repeatingly some false positves, IPs that were blocked upon decision “LePresidente/http-generic-401-bf”.
Where does this decision/role come from? I did not select the repository “LePresidente” when installing crowsec. And how can I remove this pattern? I found who to unblock the IP/decision on the host, but I don’t want to have the reason “LePresidente/http-generic-401-bf” installed.
Can someone explain please, what it does?
I also marked as “false positive” in the backend…
Thanks!
---
### Author:  [@blu-IT](https://discourse.crowdsec.net/u/blu-IT)
#### Post date: [October 31, 2022, 6:06pm UTC](https://discourse.crowdsec.net/t/lepresidente-http-generic-401-bf-false-positive-where-does-this-role-come-from/1000/2 "2022-10-31T18:06:54Z")
OK, found that rule now here:
[https://hub.crowdsec.net/author/crowdsecurity/configurations/http-generic-bf](https://hub.crowdsec.net/author/crowdsecurity/configurations/http-generic-bf)
Description:
Alert when a single IP that try to bruteforce http basic auth.
Leakspeed of 10s, capacity of 5.
Well, that’s not bad 😉 But the name/source is confusing…
I’ll close this request now.