IP Block List

SSH honeypot / attacker IPs: This section references IPs observed in SSH brute-force activity. Using a centralized list like this helps keep firewalling simpler and more consistent across servers, since you can focus access rules around a smaller set of trusted sources while tracking known noisy/hostile IP ranges.

Source: https://github.com/SamJoan/pwlist

The repository contains collected data from SSH attack traffic (honeypot/brute-force attempts), including lists and groupings derived from attacker activity (e.g., by IP/client) that can be used as a reference for maintaining an IP block list.