diff --git a/network/default-login/ftp-anonymous-login.yaml b/network/default-login/ftp-anonymous-login.yaml
index 4888a5170ba..e64ad69077b 100644
--- a/network/default-login/ftp-anonymous-login.yaml
+++ b/network/default-login/ftp-anonymous-login.yaml
@@ -30,11 +30,14 @@ tcp:
         words:
           - "Anonymous access allowed,"
           - "Logged in anonymously"
-          - "230"
+          - "230 "
         condition: or
 
       - type: word
         part: raw
         words:
           - "HTTP/1.1"
+          - "230."
+          - ".230"
         negative: true
+        condition: or