nginx-badrequests-main.conf

# setup /etc/fail2ban/filter.d/nginx-badrequests-main.conf
# fail2ban-regex "/var/log/nginx/*.access.log" /etc/fail2ban/filter.d/nginx-badrequests-main.conf --print-all-matched

[Definition]
# Notes :  Detection of 400, 403 and 444 requests.
failregex = ^<HOST> - .* "(GET|POST|HEAD).*HTTP.*" 444 0 ".+" ".+"$
            ^<HOST> - .* "POST /wp-comments-post.php HTTP.*" 403 [0-9]{1,} ".+" ".+"$
ignoreregex =