in my opinion this is just plain stupid… luckily fail2ban is realitvely fast in stopping those attacks… but they also put strain on the webserver, especially when a bot net is beeing used (loads of ips attacking at the same time) which might would be more a DDoS attack.
whois 18.104.22.168 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '22.214.171.124 - 126.96.36.199' % Abuse contact for '188.8.131.52 - 184.108.40.206' is 'email@example.com' inetnum: 220.127.116.11 - 18.104.22.168 netname: TurkTelekom descr: TT ADSL-TTnet_dynamic_gay country: tr admin-c: TTBA1-RIPE tech-c: TTBA1-RIPE status: ASSIGNED PA mnt-by: as9121-mnt created: 2010-07-27T08:55:55Z last-modified: 2010-07-27T08:55:55Z source: RIPE # Filtered role: TT Administrative Contact Role address: Turk Telekom Genel Mudurlugu phone: +90 312 555 0000 fax-no: +90 312 313 1924 admin-c: BADB3-RIPE abuse-mailbox: firstname.lastname@example.org tech-c: BADB3-RIPE tech-c: BADB3-RIPE tech-c: BADB3-RIPE nic-hdl: TTBA1-RIPE mnt-by: AS9121-MNT created: 2002-02-28T12:22:28Z last-modified: 2017-03-29T05:21:26Z source: RIPE # Filtered % Information related to '22.214.171.124/17AS9121' route: 126.96.36.199/17 descr: TurkTelecom origin: AS9121 mnt-by: AS9121-MNT created: 2006-11-20T06:52:29Z last-modified: 2006-11-20T06:52:29Z source: RIPE % This query was served by the RIPE Database Query Service version 1.88 (ANGUS) whois 188.8.131.52 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '184.108.40.206 - 220.127.116.11' % Abuse contact for '18.104.22.168 - 22.214.171.124' is 'email@example.com' inetnum: 126.96.36.199 - 188.8.131.52 netname: TR-0NLINENET-20051129 country: TR org: ORG-AETA2-RIPE admin-c: AE4263-RIPE tech-c: AE4263-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-by: onlinenet-mnt mnt-routes: onlinenet-mnt mnt-domains: onlinenet-mnt mnt-routes: AS42926-MNT created: 2016-01-08T08:59:34Z last-modified: 2016-09-21T17:21:23Z source: RIPE organisation: ORG-AETA2-RIPE org-name: Aykut Eskitoglu trading as OnlineNet org-type: LIR address: Ba?larba?? Mahallesi Cemal Bey Caddesi F?rat Sokak No 18/5 address: 34844 address: ?stanbul address: TURKEY phone: +908504551953 fax-no: +902169881653 abuse-c: AC28602-RIPE mnt-ref: onlinenet-mnt mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT mnt-by: onlinenet-mnt created: 2014-12-16T16:11:47Z last-modified: 2016-09-21T16:48:41Z source: RIPE # Filtered admin-c: AE4263-RIPE person: Aykut Eskitoglu address: Baglarbasi mah Cemalbey cad. Firat sk no 18/5 phone: +90.8504551953 abuse-mailbox: firstname.lastname@example.org nic-hdl: AE4263-RIPE mnt-by: onlinenet-mnt created: 2014-12-16T17:45:49Z last-modified: 2014-12-23T18:34:15Z source: RIPE # Filtered % Information related to '184.108.40.206/24AS42926' route: 220.127.116.11/24 origin: AS42926 mnt-by: AS42926-MNT created: 2016-09-22T10:05:49Z last-modified: 2016-09-22T10:05:49Z source: RIPE % Information related to '18.104.22.168/24AS43260' route: 22.214.171.124/24 descr: Route origin: AS43260 mnt-by: DGN-MNT