Blacklist not working – locked out IP still coming through – Brute Force Attack

This is a doublette of the post linked to below, since there is no activity there anymore but the problem is unsolved.

I was told to wait for the next update of the plugin to offer a fix, but the problem remains!

The following issue occurs:

I get Site Lockout Notifications:

A lockdown event has occurred due to too many failed login attempts or invalid username:
Username: admin
IP Address: 195.22.126.221

IP Range: 195.22.126.*

Log into your site's WordPress administration panel to see the duration of the lockout or to unlock the user.

I add IP address and IP range to blacklist
next day, I get another Notification, that the same IP tried to login
Checking the htaccess file, the IP was written in there correctly:

<IfModule !mod_authz_core.c>
Order allow,deny
Allow from all
Deny from 195.22.126.0/24
Deny from 195.22.126.221
...
<IfModule mod_authz_core.c>
<RequireAll>
Require all granted
Require not ip 195.22.126.0/24
Require not ip 195.22.126.221

I saw in the forum some threads unsolved with similar issues – is there a solution at hand now?

I shy away from buying country-blocking add-on etc. if I must fear it is not working properly…

thx for support, brute force is increasing!

For the sake of completeness, this is the relevant Apache version:
2.4.6-45.el7.centos.4

there is one IP trying to access multiple sites of mine and I can not lock it out!

Username: admin
IP Address: 193.194.69.155

IP Range: 193.194.69.*

https://www.ads-software.com/support/topic/blacklist-not-working-locked-out-ip-still-coming-through-brute-force-attack/