You can do both and use denyhosts instead of fail2ban. That one doesn't even require multiple authentication failures. Known-bad hosts are blocked because enough other people blocked them: http://stats.denyhosts.net/stats.html