# Display a list of ip address trying to discover URL to exploit
# Ip address will show up if number of invalid attempts (404 page not found) to guess an URL is greater than 3
# See breakdown below

grep /var/log/nginx/access.log -e 404 | \  # look up nginx access log for entry(s)
  awk '{print $1}' | \ .                   # print only ip address from matched entry(s)
  sort | \                                 # sort  ip address(es)
  uniq -c | \ .                            # count incidences
  sort | \                                 # re sort new list of incidences
  awk '{if ($1 > 3) print $2}' .           # finally print ip address where ip address appeared more than 3 times