rich@rich-vb-u24:~/pure-php-app$ sudo fail2ban-regex nginx/logs/access.log /etc/fail2ban/filter.d/nginx-4xx.conf --print-all-matchedRunning tests=============Use failregex filter file : nginx-4xx, basedir: /etc/fail2banUse log file : nginx/logs/access.logUse encoding : UTF-8Results=======Failregex: 104 total|- #) [# of hits] regular expression| 1) [104] ^<HOST> - - \[.*\] ".*" (403|404) .*`-Ignoreregex: 0 totalDate template hits:|- [# of hits] date format| [241] Day(?P<_sep>[-/])MON(?P=_sep)ExYear[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?`-Lines: 241 lines, 0 ignored, 104 matched, 137 missed[processed in 0.01 sec]|- Matched line(s):| 111.7.96.173 - - [06/Aug/2026:21:37:59 +0800] "GET /favicon.ico HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-"| 159.65.148.75 - - [06/Aug/2026:21:47:33 +0800] "GET /wp-login.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; GoScanner/1.0)" "-"| 159.65.148.75 - - [06/Aug/2026:21:47:33 +0800] "GET /wp/wp-login.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; GoScanner/1.0)" "-"| 159.65.148.75 - - [06/Aug/2026:21:47:34 +0800] "GET /wordpress/wp-login.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; GoScanner/1.0)" "-"| 159.65.148.75 - - [06/Aug/2026:21:47:34 +0800] "GET /blog/wp-login.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; GoScanner/1.0)" "-"| 159.65.148.75 - - [06/Aug/2026:21:47:35 +0800] "GET /manager/html HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; GoScanner/1.0)" "-"| 159.65.148.75 - - [06/Aug/2026:21:47:35 +0800] "GET /favicon.ico HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; GoScanner/1.0)" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:04 +0800] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 42733 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:06 +0800] "POST /test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 42741 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:08 +0800] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:08 +0800] "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:09 +0800] "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:10 +0800] "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:11 +0800] "GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:12 +0800] "GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:12 +0800] "GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:13 +0800] "GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:14 +0800] "GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:15 +0800] "GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:16 +0800] "GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:16 +0800] "GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:17 +0800] "GET /lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:18 +0800] "GET /lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:19 +0800] "GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:20 +0800] "GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:20 +0800] "GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:21 +0800] "GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:22 +0800] "GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:23 +0800] "GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:24 +0800] "GET /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:24 +0800] "GET /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:25 +0800] "GET /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:26 +0800] "GET /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:27 +0800] "GET /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:28 +0800] "GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:29 +0800] "GET /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:30 +0800] "GET /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:31 +0800] "GET /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:32 +0800] "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:33 +0800] "GET /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:33 +0800] "GET /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:34 +0800] "GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:35 +0800] "GET /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:36 +0800] "GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:37 +0800] "GET /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:38 +0800] "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 160.30.157.214 - - [06/Aug/2026:22:08:40 +0800] "GET /public/index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" 404 153 "-" "libredtail-http" "-"| 20.100.172.153 - - [06/Aug/2026:22:13:27 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 153 "-" "-" "-"| 20.100.172.153 - - [06/Aug/2026:22:13:27 +0800] "GET /this_is_a_new
這個測試結果非常成功！這代表您的 Fail2ban 過濾器（Filter）已經能夠 100% 精準地讀取並解析 Docker Nginx 的 access.log。
從輸出的日誌特徵中，可以看見您的網站此時此刻正在承受典型的網際網路惡意攻擊：
159.65.148.75：正在嘗試掃描常見的 WordPress 後台漏洞（如 /wp-login.php）。160.30.157.214：使用自動化工具（libredtail-http）瘋狂嘗試探測後門與 RCE 漏洞（如 phpunit 的漏洞路徑與 thinkphp 的內建函數漏洞）。由於這些探測在您的網站上都不存在，Nginx 一律回傳了 404 狀態碼，而您的正規表示式成功捕捉到了這 104 次惡意連線。
既然 fail2ban-regex 已經確認可以比對成功，接下來只要在 jail.local 中正式啟用這個 nginx-4xx 的防禦，就能立刻把這些攻擊者的 IP 拒之門外。
請在宿主機開啟設定檔：
sudo nano /etc/fail2ban/jail.local
nginx-4xx 的 Jail 設定[nginx-4xx]
enabled = true
port = http,https
filter = nginx-4xx
logpath = /home/rich/pure-php-app/nginx/logs/access.log
maxretry = 5
findtime = 600
bantime = 86400
sudo fail2ban-client reload
當您重新載入後，因為那些 IP 的攻擊頻率非常高，幾分鐘內就會達到 5 次的上限。您可以使用以下指令來查閱戰果：