What does it mean for an IP to fail “authentication” in that context? As I understand, they only check for failed connection attempts, not failed authentications?
The first thing it was integrated into was sshd, there's a small patch in sshd that sends a notification to the blacklist daemon when a connection has failed authentication.
Got it, thanks. It was surprisingly hard to find details about it except for the man page.