That was an interesting read. It made me think of the "DenyHosts" Python script I've started running on Linux servers I admin. It scans the SSH logs for activity from hackers trying to crack passwords. After a configurable threshold is reached, it configures SSH to block the machine. It can run as a daemon or you can run it from the command line on an on-demand basis.
The cool thing is it can share its blocking information with others through a central database. On one server I run it on, it has already downloaded several hundred IP addresses of machines that have engaged in hacking activity.
Thanks for sharing!
Peace...