How about using a tool like https://crowdsec.net/ https://crowdsec.net/ that collects (basic, anonymious) information from users on the attacks they see, vets i

How about using a tool like https://crowdsec.net/ https://crowdsec.net/ that collects (basic, anonymious) information from users on the attacks they see, vets it and shares it back to all users via blocklists? Currently around 800k signals are collected and there's around 19k vetted bad ips in the blocklist. Sounds more reliable to me.