This sounds like a federated fail2ban which is actually a fantastic idea. I have mentioned this before, but my experience with "hackers" has been that attacks

This sounds like a federated fail2ban which is actually a fantastic idea. I have mentioned this before, but my experience with "hackers" has been that attacks are coordinated from thousands of compromised machines. My solution thus far has been to leave the ssh port and ban any IP that tries to authenticate (leaving the option of Likewise, a few rules to catch automated sql-injection scanners and the like, has really cut down on the noise.