This is straight out of Claude so take it with a grain of salt but fail2banning bots hitting .php files on servers that don't run PHP seems to give good mileage, and I mean that long before the current php2shell. # /etc/fail2ban/filter.d/apache-php-probe.conf [Definition] failregex = ^<HOST> -.*"(GET|POST|HEAD) [^"]*\.php[^"]*" (403|404) ignoreregex = and # /etc/fail2ban/jail.d/apache-php-probe.local [apache-php-probe] enabled = true port = http,https filter = apache-php-probe logpath = /var/log/apache2/access.log maxretry = 1 findtime = 600 bantime = 3600