It doesn't necessarily need to be a high port either. All bots will check port 22 first and then move onto others. Your can have a port sniffer watching this a

It doesn't necessarily need to be a high port either. All bots will check port 22 first and then move onto others. Your can have a port sniffer watching this and block any attempts to your actual <1024 port of they've also hit port 22. It works a treat. Shodan, begone. I agree with your high pass sentiment