After using fail2ban in production I've noticed Chinese attackers will start using a massive amount of entire subnets, which eventually cause servers to crash with such long Iptable rulsets.