I do. I see no SSH attempts on the active high port. None. It may only be a matter of time of course. I continue to see French metric tonnes of attempts to subvert mysql and the Web.
We've been on the shifted port for more than 5 years.
I can confirm it makes a huge difference for SIP as well. Toll fraud attempts are not making the logs completely unreadable anymore when using a non-standard port.
We've been on the shifted port for more than 5 years.