# Fail2Ban filter: known bad-bot/scraper User-Agent strings, adapted for
# Apache's vhost-first "fail2ban" LogFormat (see apache-notes/apache-logformat.md).
#
# Install as: /etc/fail2ban/filter.d/apache-vhost-badbots.conf
#
# This reuses the stock apache-badbots.conf bad-bot signature list via
# [INCLUDES] rather than copying it, so a Debian package update to that
# list keeps applying here automatically. Only failregex/datepattern are
# overridden below.
#
# Expected log line (same vhost-first format as apache-vhost-wp-probe.conf):
#
#   [13/Sep/2026:02:48:46 -0500] wolfstream.com:443 62.60.130.27 - - "GET / HTTP/1.1" 200 3239 "-" "EmailSiphon"
#   |<------ stripped by datepattern ------>| |vhost:port|  |<HOST>|
#
# The stock filter anchors `^<HOST>` at the very start and `"$"` right after
# the User-Agent — neither survives a shared multi-vhost log, which must
# carry a vhost field somewhere and (in this LogFormat) has fields appended
# after the User-Agent too. Fix: skip one leading vhost:port token, and drop
# the end anchor so the trailing Host-header/%D fields are simply ignored.

[INCLUDES]

before = apache-badbots.conf

[Definition]

datepattern = ^\[%%d/%%b/%%Y:%%H:%%M:%%S %%z\]

failregex = ^\s*\S+ <HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"

ignoreregex =