Fail2Ban

A log-monitoring daemon that shields services from brute-force attacks by banning offending IP addresses. It watches the log files of services you care about, matches repeated failed logins and other abusive behaviour against a jail you configure, and adds a temporary firewall rule through iptables or nftables that lifts when the ban expires.

It is commonly placed in front of SSH, mail, web and database endpoints on a public server to cut off password guessing and scraping.

Running it yourself keeps the ban list and host logs inside your perimeter instead of sending them to an external service, it costs nothing per protected host, and migration means copying the jail configuration.