Fail2ban has been installed before these dates, "Failed password" count in va/log/auth.log

    957 Jul 7
    369 Jul 8
    121 Jul 9
    641 Jul 10
    694 Jul 11
   3897 Jul 12
   3583 Jul 13
   3718 Jul 14
   3981 Jul 15
   3383 Jul 16
   2420 Jul 17
    530 Jul 18
     10 Jul 19
   1319 Jul 20
    304 Jul 21
     50 Jul 22
   5417 Jul 23
    161 Jul 24
    268 Jul 25
     45 Jul 26
     12 Jul 27
     43 Jul 28

I'd be somewhat (but not totally) surprised if Debian 7's iptables are too old for the new netfilter interface too, but if you could post the dump of iptables -L -v -n to see if there are fail2ban blocks listed, it might help eliminate a possibility.

_________________
rsk, providing useless advice on the Internet since 2005.