ACZoom

This should be caught - the regex line is meant to catch above lines, for example, I fed the first three lines from your log, and ran blockhosts in debug mode, here's the output I got:


found failed access for SSHD-Fail , IP-pid: 195.140.143.60-10058
found failed access for SSHD-Fail , IP-pid: 195.140.143.60-10060
found failed access for SSHD-Fail , IP-pid: 195.140.143.60-10062


So, it got the host, and added the count to the hosts.allow file:

#bh: ip: 195.140.143.60 : 3 : 2005-12-05-09-58


I am using the latest version 1.0.3 - but this regex pattern has always existed, so should work in previous versions also.