That’s a great point regarding a false positive / compromised server acting maliciously.

One problem is that even when using a security setup like the one I’ve implemented, it’s still a one-to-one relationship.

Do you know if there’s a shared data / collective approach so for example, you and I could connect our traffic data to a shared fail2ban implementation for example?