¹anything .php,.asp and some other tech we never use, also phpmyadmin, cgi-bin, and some more, actually.
nobody own their IP, and at some point a legitimate person will be assigned that IP
and most people who do bad things on the internet use some proxies, usually residential ones
it always makes me sad when people put such rules
This means that commonly only about 30 IPs are on the banlist. The chance that anyone using the same IP as a bot who is visiting any of the apps and sites on that server is not 0%, but tiny.
The only goal is to stop bots and worms from hammering my server. It hardly improves security; it shouldn't anyway.
Drupal, PHPBB, etc all have such generic config defaults online. For frameworks such as Rails, Django etc its a bit harder because the logging and url-schemes are not standard, but defined by the person developing in that framework.