Dealing with automated SSH password-guessing

Indeed. Netblock-to-Netblock variances in bot traffic can be substantial. The new assignee of the address or netblock gets the sad benefit of inheriting whatever the previous assignees 'attack surface' drew in.

Also, just one more vote here for moving away from known and common ports for administrative services. I think I said this on LWN many years ago, but it still is true for me that moving ports means that I can pay much greater attention to *directed* attacks on *my resources*, rather than just see a sea of dumb "wardialing" bots.