diff --git a/debian/control b/debian/control
index 122b60e..77cc2f0 100644
--- a/debian/control
+++ b/debian/control
@@ -34,3 +34,4 @@ Description: ngcp modules for the prosody Jabber/XMPP server
   * mod_websocket.lua: XMPP over websocket, (c) 2012 Florian Zeitz
   * mod_sipwise_admin_telnet: admin_telnet with inteface selection
   * mod_sipwise_redis_sessions: keep server's session info on redis
+  * mod_log_auth: logs IP address in a failed authentication attempt
diff --git a/plugins/mod_log_auth.lua b/plugins/mod_log_auth.lua
new file mode 100644
index 0000000..b54780b
--- /dev/null
+++ b/plugins/mod_log_auth.lua
@@ -0,0 +1,4 @@
+
+module:hook("authentication-failure", function (event)
+	module:log("info", "Failed authentication attempt (%s) from IP: %s", event.condition or "unknown-condition", event.session.ip or "?");
+end);