I'm not sure I understand your question, particularly in relation to my comment. There were a few people involved in the conversation so it could be confusing :

I'm not sure I understand your question, particularly in relation to my comment. There were a few people involved in the conversation so it could be confusing :) I was commenting about the limitation of fail2ban and the potential for a kind of DoS if lots of users share the same IP. Then one naughty user can DoS all other users. However, what I typically do with fail2ban is look at Nginx status codes like 4xx, 5xx and then rate limit them (e.g. ban if the rate is higher than expected in a given time). We also monitor our application logs for some errors, e.g. failed authentication or registration will also get matched and banned if over a certain threshold. > The important part here is the list of scanned endpoints for blocking bad traffic is doing things the hard way. Yes, I agree with you, even though there are some patterns that might be useful for placing instant bans? e.g. "../../" or if your site is not using php, then any access to a .php$ can get banned etc.