Splitting from {T286515#7235469}.
Wikimedia has an XFF log for incident response. Currently this relies on a $wgExtensionFunctions to run after startup, but presumably this is useful for other people as well and should be moved to MediaWiki core. One subtle gotcha might be figuring out how to exclude POST requests on jobrunners in a generic, non-Wikimedia specific way.