Custom Jail for Repeat Error 444 and 403 Offenders

- New improved Regex pattern for catching Jorgee - With Great Thanks to Konstantin Goretzki @terriblespider
mariusv · Aug 20, 2017 · fbb2ffa · fbb2ffa
1 parent f38621d
commit fbb2ffa
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/Fail2Ban/filter.d/nginxrepeatoffender.conf b/Fail2Ban/filter.d/nginxrepeatoffender.conf
@@ -55,7 +55,7 @@ _daemon = fail2ban\.actions\s*
 # jail using this filter 'nginxrepeatoffender', or change this line!
 _jailname = nginxrepeatoffender
 
-failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/ \S+\" (?:403|444) .+$
+failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) .* \S+\" (?:403|444) .+$
 ignoreregex = 
 
 

diff --git a/VERSION_2/_fail2ban_addon/filter.d/nginxrepeatoffender.conf b/VERSION_2/_fail2ban_addon/filter.d/nginxrepeatoffender.conf
@@ -55,7 +55,7 @@ _daemon = fail2ban\.actions\s*
 # jail using this filter 'nginxrepeatoffender', or change this line!
 _jailname = nginxrepeatoffender
 
-failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/ \S+\" (?:403|444) .+$
+failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) .* \S+\" (?:403|444) .+$
 ignoreregex =