Right now I'm using those to add IPs that are near-guaranteed to be abusive, malicious or botnets to "long-term" fail2ban jail (set to 2 days for now). This works great: most of the attacks are blocked while I have not experienced any false positives so far.
However, I still find some attack activity in the logs. I wonder if there are more of services or software that can do such a job out there? Requirements:
- few false positives
- preferably free
- detects attacks such as brute-forcing SSHD, SMTP, IMAP, POP3, botnets, slow attacks (brute-forcing with slow back-off with simultaneous attacks from multiple IPS to get around
fail2ban- I've had some such attacks)