iptables: No chain/target/match by that name - adding SSH ATTACK rule

I have a problem with adding rule against brute-force SSH attacks. I try to do it in the following way:

iptables -F
iptables -L
iptables -N SSHATTACK
iptables -A SSHATTACK -j LOG --log-prefix "Possible SSH attack! " --log-level 7
iptables -A SSHATTACK -j DROP
#Block each IP address for 120 seconds which establishe more than three connections within 120 seconds. In case of the forth connection attempt, the request gets delegated to the SSHATTACK chain, which is responsible for logging the possible ssh attack and finally drops the request.
iptables -A INPUT -i venet0 -p tcp -m state --dport 22 --state NEW -m recent --set
iptables -A INPUT -i venet0 -p tcp -m state --dport 22 --state NEW -m recent --update --seconds 120 --hitcount 4 -j SSHATTACK

But I have a problem with these two lines:

iptables -A INPUT -i venet0 -p tcp -m state --dport 22 --state NEW -m recent --set
iptables -A INPUT -i venet0 -p tcp -m state --dport 22 --state NEW -m recent --update --seconds 120 --hitcount 4 -j SSHATTACK

Output after this command is

iptables: No chain/target/match by that name.

iptables -L gives the following output:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain SSHATTACK (0 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            LOG level debug prefix `Possible SSH attack! '
DROP       all  --  anywhere             anywhere

and iptables -S gives:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N SSHATTACK
-A SSHATTACK -j LOG --log-prefix "Possible SSH attack! " --log-level 7
-A SSHATTACK -j DROP

ip add gives (I’ve hiden IP adress with ‘?’):

1 lo LOOPBACK,UP,LOWER_UP mtu 65536 qdisc noqueue state UNKNOWN
    linkloopback 000000000000 brd 000000000000
    inet 127.0.0.18 scope host lo
    inet6 1128 scope host
       valid_lft forever preferred_lft forever
2 venet0 BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP mtu 1500 qdisc noqueue state UNKNOWN
    linkvoid
    inet 127.0.0.132 scope host venet0
    inet ?.?.?.24820 brd ?.?.?.255 scope global venet00

What can I do to add this rule? What am I missing?

iptables -A INPUT -i venet0 -p tcp --dport 22 -m state --state NEW -m recent --set