Brute force protection doesn't protect against failed logins

Check this out with fail2ban it is possible: