I use fail2ban to detect malcious requests to any of my hosted domains, which is working very well, with one exception.
If a requests is sent to the IP instead of a fqdn or a subdomain, it gets catched and written into other_vhosts_access.log since the ip itself is no virtualhost.
Example entry:
somedomain.de:80 20.37.96.167 - - [24/Jan/2020:15:47:04 +0100] "POST //4walls/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 301 587 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36"
So it seems, apache does a reverse lookup to the IP and writes down the hostname at first place.
This causes fail2ban to selfban the servers ip instead of the requesters IP.
How can i prevent the somedomain.de:80 entry?