This must be a fixed string (you cannot use * or regex), at best use the attackers` IP address or host name.