diff --git a/misc/fail2ban.rules b/misc/fail2ban.rules
new file mode 100644
index 000000000..c1d5115fd
--- /dev/null
+++ b/misc/fail2ban.rules
@@ -0,0 +1,2 @@
+failregex = ^\s*web_php\[\d+\]\.ERR \[<HOST>\].*includes/auth.php
+datepattern = ^%%m/%%d/%%y %%H:%%M:%%S(?:\.%%f)