diff --git a/utils/fail2ban/shadowsocks.conf b/utils/fail2ban/shadowsocks.conf
new file mode 100644
index 0000000..9b1c7ec
--- /dev/null
+++ b/utils/fail2ban/shadowsocks.conf
@@ -0,0 +1,5 @@
+[Definition]
+
+_daemon = shadowsocks
+
+failregex = ^\s+ERROR\s+can not parse header when handling connection from <HOST>:\d+$