Fail2Ban monitors log files like /var/log/pwdfail or /var/log/apache/error_log and bans failure-prone addresses. It updates firewall rules to reject the IP address or executes user defined commands.
Please see code and download from https://github.com/fail2ban/fail2ban . SF Fail2ban portal might not be up-to-date
WormBlock will create a script to add the IP's to your IPTables based firewall. It will scan all your apachelog files and match the IP's with the defined worm signatures. Then create the script to modify your IPTables based firewall.