ACZoom

I admit it regex has never been my strong side. What I would like to match is the following

Nov 20 21:55:30 zummer sshd[21198]: error: PAM: User not known to the underlying authentication module for root from 59.6.185.37
Nov 20 21:56:30 zummer sshd[21207]: error: PAM: User not known to the underlying authentication module for root from 61.155.105.62

I'v had a lot of these lately and even though the attempt dont constitute any risk (no root login on this box) I think the attacker has demonstrated his intention. So I tried to build a new pattern like this:

"sshd-NotKnown":
r'{LOG_PREFIX{sshd}} User not known to the underlying authentication module for .* from {HOST_IP}',

but to no avail. Blockhost does not detect the attach.

What am I doing wrong?