When incorrect_login_attempt_block_ip is set and when the user does not meet the threshold and logins correctly, we delete the monitoring entry from ipfilter db. This is if the ip_filter_default_action is set to allow.
If ip_filter_default_action is set to block and we add entries to allow ip addresses manually. When a user logs in correctly, the entry is deleted. which blocks the user by ip_filter_default_action
We need to check if the filter is manually added to make sure the entry is not deleted.