diff --git a/samples/fail2ban/filter.d/roundcube.iredmail.conf b/samples/fail2ban/filter.d/roundcube.iredmail.conf
index c14540ad..427cc18c 100644
--- a/samples/fail2ban/filter.d/roundcube.iredmail.conf
+++ b/samples/fail2ban/filter.d/roundcube.iredmail.conf
@@ -1,9 +1,9 @@
 # 'X-Forwarded-For:` appears when Roundcube is running behind HAProxy.
 
 [Definition]
-failregex = roundcube.* Failed login for (.*) from <HOST>\. AUTHENTICATE LOGIN
+failregex = roundcube.* Failed login .*\(X-Forwarded-For: <HOST>\) in session
+            roundcube.* Failed login for (.*) from <HOST>\. AUTHENTICATE LOGIN
             roundcube.* Failed login for (.*) from <HOST> in session
-            roundcube.* Failed login .*\(X-Forwarded-For: <HOST>\) in session
             roundcube.* Error: Login failed for (.*) from <HOST>\. (LOGIN: Authentication failed|AUTHENTICATE LOGIN)
 
 ignoreregex =