No, fail2ban watches logs for repeatedly failed login attempts, and then blackholes given IPs using firewall rules. I prefer denyhosts, which is more ssh-specific.

Could you elaborate on that? fail2ban seems quite popular for blocking malicious IPs.

from the user's profile https://news.ycombinator.com/user?id=kbar13

"I work for Linode, but everything I say is me being an idiot." so..