fail2ban nginx ban scanners and unauthorized access

npm-auth.conf

#/etc/fail2ban/filter.d/npm-auth.conf

[INCLUDES]

[Definition]

failregex = ^ \[error\] \d+#\d+: \*\d+ user "(?:[^"]+|.*?)":? (?:password mismatch|was not found in "[^\"]*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$

npm-auth.local

#/etc/fail2ban/jail.d/npm-auth.local

[npm-auth]
enabled = true
chain=INPUT
maxretry = 2
bantime = 168h #7 days
findtime = 24h
logpath =/root/nginx/data/logs/proxy-host-*_error.log
action = iptables[name=npm, port=0:65353, protocol=tcp]
         telegram

npm-error.conf

#/etc/fail2ban/filter.d/npm-error.conf

[INCLUDES]

[Definition]

failregex = ^ \[warn\] \d+#\d+: \*\d+ using uninitialized "(.*?)" variable while logging request, client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$

npm-error.local

#/etc/fail2ban/jail.d/npm-error.local

[npm-error]
enabled = true
chain=INPUT
maxretry = 1
bantime = 168h #7 days
findtime = 72h
logpath = /root/nginx/data/logs/proxy-host-*_error.log
action = iptables[name=npm, port=0:65353, protocol=tcp]
         #telegram #Commented for my mental sanity

npm-redirect.conf

#/etc/fail2ban/filter.d/npm-redirect.conf

[INCLUDES]

[Definition]

failregex = <HOST>

npm-redirect.local

#Configuration to ban anyone who falls into the nginx proxy manager default (unmapped subdomains or direct http access on public IP)
#/etc/fail2ban/jail.d/npm-redirect.local

enabled = true
chain=INPUT
maxretry = 1
bantime = 168h # 7 days
findtime = 48h
logpath = /root/nginx/data/logs/default-host_access.log

action = iptables[name=npm, port=0:65353, protocol=tcp]
         #telegram #Commented for my mental sanity