Changes to negative index to prevent banning of arbitrary addresses

Previous index allows a wisenheimer to attempt to login as "8.8.8.8 a a"@host, which can cause the following:
```
>>> line = "Dec 30 18:33:59 ubuntu sshd[3551]: Failed password for invalid user 8.8.8.8 a a from 127.0.0.1 port 59698 ssh2"
>>> line.split(" ")[10]
'8.8.8.8'
```

Resulting in the ban of any IP.