--- src/parser/attack_scanner.l.orig	2012-12-19 10:58:02.992356246 +0000
+++ src/parser/attack_scanner.l	2012-12-19 10:58:22.407356894 +0000
@@ -127,7 +127,7 @@
 
 
  /* SSH: invalid or rejected user (cross platform [generated by openssh]) */
-"Invalid user ".+" from "                         { return SSH_INVALUSERPREF; }
+[Ii]"nvalid user ".+" from "                         { return SSH_INVALUSERPREF; }
  /* match disallowed user (not in AllowUsers/AllowGroups or in DenyUsers/DenyGroups) on Linux Ubuntu/FreeBSD */
  /* "User tinydns from 1.2.3.4 not allowed because not listed in AllowUsers" */
 "User ".+" from "                                               { BEGIN(ssh_notallowed); return SSH_NOTALLOWEDPREF; }