diff --git a/filters/proftpd.preg b/filters/proftpd.preg
new file mode 100644
index 0000000..a6421ce
--- /dev/null
+++ b/filters/proftpd.preg
@@ -0,0 +1,7 @@
+# set: defscore=30
+\(.*\[<HOST>\]\): SECURITY VIOLATION: Root login attempted
+# set: defscore=15
+\(.*\[<HOST>\]\): USER .*: no such user found
+\(.*\[<HOST>\]\): USER .* \(Login failed\): Incorrect password
+# set: defscore=1
+\(.*\[<HOST>\]\): FTP session opened