Hello to All Fail2ban Users ;

I am new on Fail2Ban and also I’m new on Regex.
I want to block brute force attacks to PROFTPD on my Centos server.
I have got secure log file in \var\log\secure.

Now, I need REGEX expression.

I tried this, but nothing happened : 
USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$

My log file content like this : 

Apr 27 11:38:26 server proftpd[28668]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:27 server proftpd[28688]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:28 server proftpd[28696]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:31 server proftpd[28708]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:32 server proftpd[28722]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:34 server proftpd[28730]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:35 server proftpd[28732]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:36 server proftpd[28733]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:38 server proftpd[28734]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:39 server proftpd[28737]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21
Apr 27 11:38:40 server proftpd[28739]: 100.100.100.100 (113.21.228.78[113.21.228.78]) - USER test@test.com: no such user found from 113.21.228.78 [113.21.228.78] to 100.100.100.100:21



Thank you for your response.
Have a nice day