Ban notices that say who you just banned.
Fail2Ban's mail actions already run a whois on every banned address. Point that lookup
at Prefix WhoIs and the notice arrives with the origin AS, the organization, the network name and the country from the
live global routing table. One file, one line, no new software.
Fail2Ban 0.10 and later
The mail-whois, mail-whois-lines, sendmail-whois and
sendmail-whois-lines actions, which is what action_mw and action_mwl select.
Needs a whois client and timeout (coreutils) on the host.
Before and after
The IP 203.0.113.9 has just been banned by Fail2Ban after 5 attempts against sshd. Here is more information about 203.0.113.9 : % [whois.apnic.net] % Information related to '203.0.113.0 - 203.0.113.255' inetnum: 203.0.113.0 - 203.0.113.255 netname: ... (forty more lines of registry text)
The IP 203.0.113.9 has just been banned by Fail2Ban after 5 attempts against sshd. Here is more information about 203.0.113.9 : IP: 203.0.113.9 Origin-AS: 64496 Prefix: 203.0.113.0/24 AS-Path: 8220 3356 64496 AS-Org-Name: Example Hosting Ltd Org-Name: Example Hosting Ltd Net-Name: EXAMPLE-NET-1 Cache-Date: Sep 13 2026 07:19:46 City: Amsterdam Country-Code: NL Route-Originated-Date: Aug 28 2026 08:42:19
Addresses in the example are documentation ranges; a real notice shows the real network.
Setup
1. Create /etc/fail2ban/action.d/mail-whois-common.local with this content:
Fail2Ban reads the .local file after the shipped mail-whois-common.conf, so the
override survives package upgrades. Leave the shipped file alone.
2. Use a mail-with-whois action in the jails you want it for. In jail.local, for one jail or
under [DEFAULT]:
action_mwl also attaches the matching log lines. Set destemail and sender
as usual.
3. Reload and check the resolved command:
The last command prints the notice template with your whois -h whois.pwhois.org line inside it.
Substitute mail-whois for sendmail-whois if your mta is mail.
4. Try the lookup by hand once, so the first real ban holds no surprises:
What the line does
timeout 15 keeps a slow network from stalling the action. Fail2Ban runs the whois while it
builds the notice; without a timeout a hung lookup holds the ban queue.
app="fail2ban" identifies the query as coming from Fail2Ban. It changes nothing in the answer.
It lets the service recognise the traffic and is what you would mention when asking for a larger allowance.
type=all returns the routing record plus the registry fields (net range, registration dates,
technical handle). Drop it for the shorter routing-only record shown above.
|| echo ... puts a one-line note in the notice instead of an empty section when the lookup
fails, matching what the shipped file does for a missing whois program.
Allowance
Every address gets 5,000 Prefix WhoIs queries a day, counted by the address the queries come from and reset at 00:00 UTC. Hosts behind one NAT address share one allowance. Fail2Ban spends one query per ban, so a quiet server never notices, while an exposed SSH host that bans thousands of addresses a day will. In that case apply the override to the jails whose notices you actually read, or ask for a higher allowance; they are customarily granted free for reasonable use.
When the allowance is used up the answer is a short notice rather than a record, and that notice is what lands in the mail until the reset.
Notes
IPv6 bans are looked up the same way; the routing table has both families.
Charset conversion. If you switched _whois_command to _whois_convert_charset in
your .local, keep it; the override above only changes _whois, which that wrapper calls.
Other actions. complain and abuseipdb do not use _whois and are not
affected.
History. A pull request to add Prefix WhoIs to Fail2Ban's whois actions has been open since December 2013. This page is the faster route, and it is also the shape the reviewers asked for: one parameter, no new action files.
Headers on the mail itself. If you want the same data on every incoming message rather than every ban, that is the Milter or the plug-in for Rspamd.
Questions or corrections through the contact form. The other ways to use Prefix WhoIs from your own tools are on the Integrations page.