First blacklistd would be better, because as written the applications knows better what to "ban" than a log-scanner. I often use a combination of: -blacklistd

First blacklistd would be better, because as written the applications knows better what to "ban" than a log-scanner. I often use a combination of: -blacklistd and fail2ban (for applications who don't support blacklistd) -pfbadhost (nearly always) -CrowdSec (just sometimes, but atm pretty happy with the free service) I use those to have clean logs, block spammers at ip level, and "marketing" crawlers...well and other stuff. And no, ssh is never on 22, i like clean logs to better find the real "interesting" stuff.