Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like mod_evasive, monitoring requests as they come in but has the ability to control what gets blocked using keywords or regex.
For example, anytime anyone requests something like "../etc/passwd" - I would like to drop that IP address for a few days. I've looked at fail2ban as well, but it does the same thing as blockhosts, monitors log files. not exactly what I am looking for.
Anyway, the server is CentOS running Apache 2.2, in a paralells virtual host container & hosting about 100 sites, so I only have web access to the virtual machines host servers firewall & trying to jam in rewrite rules in each domain's htaccess will not be maintainable.