@yarikoptic :
yes a convention separating ban and injection IPs is good. Is another set needed for unrelated IPs like localhost. @buanzo raises a good pint on RFCs.

Injection. Added an attempt using: <pre>curl -g  'ftp://platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (hihoinjection[1.2.3.44]):badpass@platypus.ace-hosting.com.au'</pre>

It fails because a username can't contain a space (according to the filter) but really proftpd can handle it. Good news, its not a vulnerabilty, bad news - its a weakness that usernames with spaces aren't protected. Crying yet? Will fix this next commit.