Fail2Ban problem

[lord_Niedzwiedz]

	Witam, Fail2Ban nie wychwytuje mi reguł na PLD (kiedyś mi to działało).

Serwer jest atakowany takimi zapytaniami:
184.105.139.197 - - [16/Dec/2014:13:28:33 +0100] "GET 
http://ib.adnxs.com/tt?id=3975533&cb=[CACHEBUSTER]&referrer=sky.com&pubclick=[INSERT_CLICK_TAG] 
HTTP/1.0" 403 284
100.42.230.194 - - [16/Dec/2014:13:28:33 +0100] "GET 
http://anx.batanga.net/ttj?id=3954879&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]&pubclick=[INSERT_CLICK_TAG] 
HTTP/1.0" 403 288


Czyli teoretycznie wystarczy zrobić regułkę dla ib.adnxs.com oraz 
anx.batanga.net.


W pliku mam.
vim apache-badbots.conf

[Definition]

badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou 
music 
spider|ad\.adserverplus\.com|ib\.adnxs\.com|anx\.batanga\.net|batanga\.net

badbots = Atomic_Email_Hunter/4\.0|autoemailspider|......tu 
wycialem....|WEP Search 00|ib\.adnxs\.com|anx.batanga\.net|batanga\.net

failregex = ^<HOST> 
-.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
             ^<HOST> -.*(adnxs)$

ignoreregex =


Przy starcie Fail2Ban wysyła e-maile.
Oraz dodaje reguły:
Chain fail2ban-BadBots (0 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Niestety na tym koniec   ;-/
W logach mam:
2014-12-16 13:31:21,771 fail2ban.jail   : INFO   Creating new jail 
'apache-badbots'
2014-12-16 13:31:21,772 fail2ban.jail   : INFO   Jail 'apache-badbots' 
uses poller
2014-12-16 13:31:21,773 fail2ban.jail   : INFO   Initiated 'polling' backend
2014-12-16 13:31:21,774 fail2ban.filter : INFO   Added logfile = 
/var/log/admin_fail2ban/httpd/access_log
2014-12-16 13:31:21,775 fail2ban.filter : INFO   Set maxRetry = 2
2014-12-16 13:31:21,776 fail2ban.filter : INFO   Set findtime = 600
2014-12-16 13:31:21,776 fail2ban.actions: INFO   Set banTime = 172800

2014-12-16 13:31:22,123 fail2ban.actions.action: ERROR 
fail2ban-iptables -N fail2ban-BadBots
fail2ban-iptables -A fail2ban-BadBots -j RETURN
fail2ban-iptables -I INPUT -p udp,tcp -m multiport --dports http,https 
-j fail2ban-BadBots returned 200


Ktoś ma jakieś sugestie co może być nie tak ?
Grzegorz  Misiek