Is this normal behavior?

Start with the Rack::Attack configuration and request logs in the issue, then look for project documentation or tests covering Fail2Ban filters and the blocklisted responder. Done means establishing whether this behavior is expected and, if not, identifying a reproducible defect; the issue names no code file or test to start from.

I see this daily in the logs with Rack Attack configured (I believe properly).
Someone will starting looking for a way in, the first few requests 404, and then the rest are just GETs with no other information. I'm 99% sure that means RA is blocking, but I would think fail2ban would prevent those further requests from showing up in the logs, no?

class Rack::Attack
	Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
	Rack::Attack.blocklist('fail2ban pentesters') do |req|
		Rack::Attack::Fail2Ban.filter("pentesters-#{req.ip}", maxretry: 3, findtime: 10.minutes, bantime: 500.minutes) do
			req.path.include?('wp-') ||
			req.path.include?('graphql') ||
			req.path.include?('/ip') ||
			req.path.include?('.git') ||
			req.path.include?('.env') ||
			req.path.include?('admin') ||
			req.path.include?('php')
		end
	end
	Rack::Attack.blocklisted_responder = lambda do |request|
		[ 503, {}, ['Blocked']]
	end
end

Example logs:

I, [2026-10-05T12:21:03.024862 #1123682]  INFO -- : [7ebbbf57-32f0-4887-805e-8df59176d295] Started GET "/z9x8c7v6b5-debug-trigger" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.025187 #1123682]  WARN -- : [7ebbbf57-32f0-4887-805e-8df59176d295] [404] ActionController::RoutingError (No route matches [GET] "/z9x8c7v6b5-debug-trigger")
I, [2026-10-05T12:21:03.033213 #1123680]  INFO -- : [e407f7f6-9bdb-454e-bd9c-bfae3ea5e903] Started GET "/asset-manifest.json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.033546 #1123680]  WARN -- : [e407f7f6-9bdb-454e-bd9c-bfae3ea5e903] [404] ActionController::RoutingError (No route matches [GET] "/asset-manifest.json")
I, [2026-10-05T12:21:03.034689 #1123678]  INFO -- : [9f7cc2c4-e67e-4d7c-826a-a0ee356c010f] Started GET "/520icddtd1ird2b27bcj" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.034884 #1123680]  INFO -- : [f208d9f9-13ff-4dd9-8df8-02f2b93f30ee] Started GET "/static/manifest.json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.035034 #1123680]  WARN -- : [f208d9f9-13ff-4dd9-8df8-02f2b93f30ee] [404] ActionController::RoutingError (No route matches [GET] "/static/manifest.json")
W, [2026-10-05T12:21:03.035107 #1123678]  WARN -- : [9f7cc2c4-e67e-4d7c-826a-a0ee356c010f] [404] ActionController::RoutingError (No route matches [GET] "/520icddtd1ird2b27bcj")
I, [2026-10-05T12:21:03.035403 #1123682]  INFO -- : [1f7955de-8e3c-42a9-b93c-137c69513f7d] Started GET "/dist/manifest.json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.035578 #1123682]  WARN -- : [1f7955de-8e3c-42a9-b93c-137c69513f7d] [404] ActionController::RoutingError (No route matches [GET] "/dist/manifest.json")
I, [2026-10-05T12:21:03.036233 #1123680]  INFO -- : [4085f9f7-2477-4704-8913-4f43cdb18066] Started GET "/assets/manifest.json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.036393 #1123680]  WARN -- : [4085f9f7-2477-4704-8913-4f43cdb18066] [404] ActionController::RoutingError (No route matches [GET] "/assets/manifest.json")
I, [2026-10-05T12:21:03.072588 #1123682]  INFO -- : [8ab040be-8060-46c3-9851-ac2c50db6506] Started GET "/01fqrhhvjqak5gn22zf6" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.072780 #1123682]  WARN -- : [8ab040be-8060-46c3-9851-ac2c50db6506] [404] ActionController::RoutingError (No route matches [GET] "/01fqrhhvjqak5gn22zf6")
I, [2026-10-05T12:21:03.073599 #1123683]  INFO -- : [38f74ffb-52c7-40bf-86a0-b4beac0fbafb] Started GET "/webpack-stats.json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.073887 #1123683]  INFO -- : [a68687d7-5853-4fdb-8a6d-8b39dcbad4f8] Started GET "/manifest.json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
W, [2026-10-05T12:21:03.074217 #1123683]  WARN -- : [38f74ffb-52c7-40bf-86a0-b4beac0fbafb] [404] ActionController::RoutingError (No route matches [GET] "/webpack-stats.json")
W, [2026-10-05T12:21:03.074394 #1123683]  WARN -- : [a68687d7-5853-4fdb-8a6d-8b39dcbad4f8] [404] ActionController::RoutingError (No route matches [GET] "/manifest.json")
I, [2026-10-05T12:21:03.082084 #1123683]  INFO -- : [303e85b5-e13f-4823-8368-001c8846e52c] Started POST "/graphql" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.239798 #1123683]  INFO -- : [058f9b3e-b4ce-4116-a904-9a3a1351f5c7] Started POST "/api/graphql" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.243611 #1123683]  INFO -- : [3e94fb40-0b6b-4515-b2a5-a2305764eb80] Started GET "/wp-json" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.248038 #1123680]  INFO -- : [a7e67ceb-55d0-403b-8f24-868f7d976642] Started GET "/media../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.251924 #1123680]  INFO -- : [1bb02469-6c23-47c7-8e98-1cd30d11630a] Started GET "/static../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.260106 #1123678]  INFO -- : [17dc17e8-6eb9-4338-ae22-1ca7f0103f31] Started GET "/files../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.261602 #1123678]  INFO -- : [d33e8a29-950f-410d-9a8c-1b8e5cee17bc] Started GET "/config/.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.376614 #1123683]  INFO -- : [adb702f8-7a29-4d49-955f-461cc48d08ee] Started POST "/v1/graphql" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.381130 #1123683]  INFO -- : [387d397d-8bb5-429a-81a5-b4302e01bb98] Started GET "/uploads../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.384309 #1123683]  INFO -- : [3ce125f5-1219-4b09-bb71-42dcfe8306ab] Started GET "/images../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.387041 #1123682]  INFO -- : [ca209681-4b1d-46cc-bf7a-219dbc2fef32] Started GET "/img../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400
I, [2026-10-05T12:21:03.398325 #1123682]  INFO -- : [ce99e61c-f76f-45e3-8733-92b984f698f6] Started GET "/assets../.env" for 136.66.96.255 at 2026-10-05 12:21:03 -0400