The failregex should preferably be of a form like
^.*\[Note\] Access denied for user.*<HOST>.*\(using password: YES\)$
and note that...
In reaction to the question
I can only state: it is not entirely clear "why".
I can mention that, at least in my experience,...
Some important remarks with respect to your last post:
1 - it is not needed to use the include directive, just place the blockips.conf...
To be honest, the whole Nginx config is a bit of a mess (understatement).
You are probably getting the 404 errors due to these lines...
My advice: back to basics.
The short summary is: Nginx with fpm is "fancy stuff", getting you into trouble.
In fact, Nginx with fpm...
Separate names with a comma.