How to secure static IP address of instance from bot attacks?

I have several instances with virtual hosts set up, and the default host document root is /opt/bitnami/wordpress. All of my virtual host records point to their respective domain name/website directory. When someone visits the static IP address of the instance directly, it loads a forbidden error page, which is fine but when bots are attacking the static IP address, I don't know how to limit or prevent the attack. I have fail2ban running, but doesn't seem to be stopping them.

Is there something I can do with the default first virtual host record to stop direct access or at least send them away or limit them somehow?

One other consideration is that I'd still like to be able to test websites the way I usually do by accessing the static IP address with the directrory name. e.g. 11.22.333.444/domain.com.