Yer i got it working by using syslog for all failed passwords, rather than auth.log
failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*
works a treat.
On Debian (etch) you will have to do this, for it to work (or at least i seemed to have to)
echo "yes" > /etc/pure-ftpd/conf/DontResolve