Here is how to block Scanalert bots using csf.
wget -q -O- http://www.mcafeesecure.com/help/ScanIps.csv | awk 'NR < 4 { next } { print }' | cut -d"," -f1 | replace '"' '' — | sort -n > /etc/csf/csf.denyscanalert
To include these blocks in CSF, add this to /etc/csf.deny :
Include /etc/csf/csf.denyscanalert
and restart csf: service csf restart