Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities?
I have an nginx web server that serves only static content. I routinely get requests for
GET /db/websql/main.php or
GET /db/phpMyAdmin2/main.php. Those are clear signs of somebody scanning for vulnerabilities. Is there an application that can go through the nginx logs, recognize these attempts to exploit common vulnerabilities and block the offending IPs? My idea is that, even if I am not vulnerable to those exploits, the same IPs could engage in other kinds of attacks on the same box or other boxes on my network: SMTP, SSH, other web servers with web applications. Blocking them while caught with their hands in the cookie jar seems a good approach to me.
Fail2ban does something similar for SSH and for HTTP authentication attempts. Maybe it could be used with a configuration that includes a list of well-known addresses used for vulnerabilities. Is there such a configuration available?