Yep fail2ban is indeed a great alternative way to tackle the issue. Although fail2ban works by blocking specific IPs. If the brute force specifies a new IP for each attempt, I'm not sure how that will be handled by fail2ban

fail2ban is such a great software and flexible. I'm using it to protect ssh and nginx with specific rules to block php and cgi requests (since my site is purely static).