6
Actually, that looks like it is working.
Protector's bad IP works at the application level. That means Apache still gets the request, and launches the task. Protector checks the list, and when it matches, it sends out a short message like "You are registered as BAD_IP by Protector." Then it ends the task.
In the apache log, that will still be a 200 (found) with a small byte count.
In your log screen shot, all the 216.244.66.230 requests are logged as:
...HTTP/1.0" 200 289 "-"...
The 289 is the byte count of the reply, which is about right for the banned message, and much too small for a real page view.
That indicates that it is doing what it is supposed to do. To stop the transactions completely would require a firewall that stopped the requests before they reached Apache. The protector filter is just minimizing the load as best it can from inside the PHP script.
