diff --git a/plugins/Channel/test.py b/plugins/Channel/test.py
index aa11982eb..48f3efe51 100644
--- a/plugins/Channel/test.py
+++ b/plugins/Channel/test.py
@@ -245,9 +245,9 @@ def join():
                             '*!user@host.domain.tld')
         join()
         with conf.supybot.protocols.irc.banmask.context(['account']):
-            # falls back from --account to config, then to exact hostmask
+            # falls back from --account to config, then to only the host
             self.assertKban('kban --account foobar',
-                            'foobar!user@host.domain.tld')
+                            '*!*@host.domain.tld')
         join()
         self.assertKban('kban --account --host foobar',
                         '*!*@host.domain.tld')
@@ -277,9 +277,9 @@ def join():
                             '*!user@host.domain.tld')
         join()
         with conf.supybot.protocols.irc.banmask.context(['account']):
-            # falls back from --account to config, then to exact hostmask
+            # falls back from --account to config, then to only the host
             self.assertKban('kban --account foobar',
-                            'foobar!user@host.domain.tld')
+                            '*!*@host.domain.tld')
         join()
         self.assertKban('kban --account --host foobar',
                         '*!*@host.domain.tld')
diff --git a/src/conf.py b/src/conf.py
index ed5c7d4d8..f090816b3 100644
--- a/src/conf.py
+++ b/src/conf.py
@@ -1316,7 +1316,12 @@ def makeExtBanmasks(self, hostmask, options=None, channel=None, *, network):
         if (bnick, buser, bhost) == ('*', '*', '*') and \
                 ircutils.isUserHostmask(hostmask) and \
                 not masks:
-            masks.append(hostmask)
+            # still no ban mask found, fallback to the host, if any
+            if host != '*':
+                masks.append(ircutils.joinHostmask('*', '*', host))
+            else:
+                # if no host, fall back to the exact mask provided
+                masks.append(hostmask)
 
         return masks