@abcdw with sshguard enabled, that adds the failed login sources to an nftables ipset, or a pf table