diff --git a/config/fail2ban/nextcloud.conf b/config/fail2ban/nextcloud.conf
new file mode 100644
index 0000000..46235b1
--- /dev/null
+++ b/config/fail2ban/nextcloud.conf
@@ -0,0 +1,4 @@
+[Definition]
+failregex=^{"reqId":".<em>","remoteAddr":".</em>","app":"core","message":"Login failed: '.<em>' &#40;Remote IP: '<HOST>'&#41;","level":2,"time":".</em>"}$
+        ^{"reqId":".<em>","level":2,"time":".</em>","remoteAddr":".<em>","app":"core".</em>","message":"Login failed: '.<em>' &#40;Remote IP: '<HOST>'&#41;".</em>}$
+        ^.<em>\"remoteAddr\":\"<HOST>\".</em>Trusted domain error.*$
\ No newline at end of file