That sounds interesting, could you share the script?

I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.