diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index a25ef3db..8bf4fc5f 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -15,6 +15,7 @@
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+             login authenticator failed for .* \[<HOST>\]: 535 Incorrect authentication data \(set_id=.*\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
new file mode 100644
index 00000000..dd507379
--- /dev/null
+++ b/testcases/files/logs/exim
@@ -0,0 +1,2 @@
+# From IRC 2013-01-04
+2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)