There are bots out there that will attack from thousands if not 10's of thousands of IPs... It's impossible to ban the individual IPs byh hand, so I let them tell me who they are by leaving the SSH port open and have fail2ban ban any IP that fails to authenticate for a month.

This had an unintended effect... most of my automated HTTP(s) attacks stopped as well-- presumably because the IPs of compromised machines were already blocked.