To block crawlers without a DNS-entry, a simple solution sets HostnameLookups On in the apache configuration, then creates a filter apache-numeric-ip.conf :
[Definition]
failregex = ^<ADDR>.*$
and adds it to jail.local :
[apache-numeric-ip]
enabled = true
filter = apache-numeric-ip
logpath = /var/log/apache2/access.log
maxretry = 5
findtime = 5m
bantime = 8h
Is this possible with hostname lookup off and a means inside fail2ban? The <HOST> pattern matches both, so it cannot be used for ignore regex
Unfortunately, logresolve has no daemon mode.
