We have continuous distributed dictionary attacks on our SSH servers, with attempts from literally thousands of IP addresses at a cadence designed not to trigger rate alerts.

We moved from port 22, and within days all ports were scanned and the attacks started again on the new port.

We are working on a different scheme to thwart the attackers.