[ycombinatorrio]

I run endlessh on the port 2222 and I configured fail2ban to redirect the source ip addresses who did X failed attempts from the dest port 22 to the dest port 2222 transparently. I use the table NAT and prerouting to achieve that, you can use ipset to match the source ip addresses.

[pdimitar]

Oh nice, do you have a blog post detailing it step by step?

[withinboredom]

I do something similar except send them bytes from /dev/random, providing free protocol fuzzing.