Question Sudden drop in Fail2Ban banned IPs — anyone else seeing this?

[Azurel]

Server operating system version

AlmaLinux 9.8

Plesk version and microupdate number

18.0.81#2

Hi everyone,

for years, my total number of banned IPs hovered around 3,000. Over the past few days, I’ve noticed that the number of banned IPs has dropped to around 700. That’s unusually low, and quite a surprise. Has anyone else noticed something similar? Fewer attacks would be welcome, but such a sharp drop after years of fairly consistent numbers seems unusual. Could this be a bug, or have the default ban times been shortened recently? fail2ban is running and banning

 

[Sebahat.hadzhi]

Hi, @Azurel . As far as I am aware, no changes related to fail2ban were recently performed. I also can't find recent bug reports with similar symptoms. Could you please check if you have some failures in the logs:

journalctl -u fail2ban

 

[Bitpalast]

@Azurel Number of attacks went up sharply this year, so it is very unlikely that less attacks are coming in to your server. But maybe you are experiencing a change in the attack scheme that F2B cannot catch without modifications: Many large scale attackers are now using distributed attacks across many websites on the same server "at once", either from the same IP or sometimes from a handful of IPs. These occur at almost the same moment across many websites on the same system, hence go unnoticed by F2B. They are not actually brute-forcing, but rather checking for .env files, backup files, .gz, .zip etc. - anything that promises to deliver backup copies of access credentials. So there might be a shift of computing power on hackers' side away from useless attempts of brute-forcing to these multiple bad bot attacks. I call them "bot burst", maybe that can make the standard name for the scheme some day ...