[tetris11]

I'd recommend grepping "(Failed|Invalid)" to capture more IPs

[mtekman]

I use the same pattern for my iptables banner.

It's essentially a manual firewall for when I disable ufw if it's being too aggressive:

https://gitlab.com/mtekman/iptables-autobanner