This isn't about deflecting a targeted attack, it's about reducing the amount of noise in your logs so that it becomes easier to detect a targeted attack. For

This isn't about deflecting a targeted attack, it's about reducing the amount of noise in your logs so that it becomes easier to detect a targeted attack. For the same reason, assuming you must expose SSHD to the world, it makes sense not to expose it on port 22. If you set up a machine on AWS EC2 and give it a public IP address, you can watch in near-realtime as the "admin/admin" login attempts come in (last time I tried this on a whim it took less than a minute).