I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those passwords, since those brute force systems checked with those passwords, I would imagine that they could try again with the same set of passwords against other accounts and thus not having such passwords used anywhere on my systems would probably be a good idea...
Of course, over time I could end up blacklisting a very large number of otherwise really good passwords. So my question about brute force password checking over the Internet would be:
Has anyone made some collection of the passwords used by such brute force attempts? And if such collections exist, what are the stats on reuse/retest of a certain set of passwords? (i.e. are those robots always re-using the same set of passwords? Are these always checking with completely different passwords?)