ah -- sorry for not being clear, e.g. the last one (first example line) coul be

```Blocking <HOST> - too much AUTH errors\s\(\d+\);\s$```

this way it becomes more rigid and if someone manages to pass something like ```Blocking 217.194.197.97 - too much AUTH errors``` as a login name logged in some other line, we would still be safe since hopefully login name is never logged just at the end of the line, does it? ;-)  also see other example failregex definitions, e.g. in sshd