diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
index 56ba499f..6f266fb5 100644
--- a/config/filter.d/wuftpd.conf
+++ b/config/filter.d/wuftpd.conf
@@ -12,6 +12,7 @@
 # Values: TEXT
 #
 failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$
+            wu-ftpd(?:\[\d+\])?: *failed login from .*\[<HOST>\] *$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/wu-ftpd b/testcases/files/logs/wu-ftpd
new file mode 100644
index 00000000..b6b41613
--- /dev/null
+++ b/testcases/files/logs/wu-ftpd
@@ -0,0 +1,2 @@
+# This login line is from syslog
+Oct  6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173]