From ae3edd825e63adfea35ccd307c3dc3fa4029474f Mon Sep 17 00:00:00 2001
From: Alex 'AdUser' Z <ad_user@runbox.com>
Date: Thu, 4 Oct 2018 15:43:02 +1000
Subject: [PATCH] * update filters

---
 filters/nginx-bots.pcre | 2 ++
 filters/ssh.preg        | 1 +
 2 files changed, 3 insertions(+)

diff --git a/filters/nginx-bots.pcre b/filters/nginx-bots.pcre
index e63a873..9006df6 100644
--- a/filters/nginx-bots.pcre
+++ b/filters/nginx-bots.pcre
@@ -23,3 +23,5 @@
 <HOST> .* "(GET|HEAD|POST) .* "DotBot/[0-9a-z\.]+
 <HOST> .* "(GET|HEAD|POST) .* "MauiBot
 <HOST> .* "(GET|HEAD|POST) .* SiteExplorer/[0-9a-z\.]+
+<HOST> .* "(GET|HEAD|POST) .* MJ12bot
+<HOST> .* "(GET|HEAD|POST) .* WebIndex
diff --git a/filters/ssh.preg b/filters/ssh.preg
index 940dafb..ce2d79d 100644
--- a/filters/ssh.preg
+++ b/filters/ssh.preg
@@ -1,6 +1,7 @@
 [Aa]uthentication failure for .* from <HOST>( via [[:print:]]*)?
 [Aa]uthentication error for .* from <HOST>( via [[:print:]]*)?
 User not known to the underlying authentication module for .* from <HOST>
+Failed password for .* from <HOST>
 refused connect from [[:print:]]+ \(<HOST>\)
 Received disconnect from <HOST>: [0-9]*: [[:print:]]+: Auth fail
 Did not receive identification string from <HOST>