ACZoom

That's my output on Gentoo Linux with (a nearly) default sshd_config:
Jun 25 12:59:04 jutta sshd[4142]: Server listening on 0.0.0.0 port 88.
Jun 25 20:11:41 jutta sshd(pam_unix)[16720]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.48.5 user=krf
Jun 25 20:11:43 jutta sshd[16714]: error: PAM: Authentication failure for krf from xx.xx.48.5
Jun 25 20:11:43 jutta sshd(pam_unix)[16721]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.48.5 user=krf
Jun 25 20:11:46 jutta sshd[16714]: error: PAM: Authentication failure for krf from xx.xx.48.5
Jun 25 20:11:47 jutta sshd(pam_unix)[16722]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.48.5 user=krf
Jun 25 20:11:49 jutta sshd[16714]: error: PAM: Authentication failure for krf from xx.xx.48.5

I'm using this solution which is working fine for me:
"SSHD-wrongpass": r"""sshd\[\d+\]: error: PAM: Authentication failure for (?P<user>.*?) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""",