[justsomehnguy]

> you just become of more interest

Exactly the opposite. If you did change the default than it can signal what you are harder to break. Malware owners aren't interested in 'more interesting' addresses or machines, they are interested in machines which can be easily identified to be susceptible for exploiting. In the end their ware is a cheap computing resources.

If you ever run machines in a diverse environments then you could had seen by just a simple 'There were N failed attempts since last logon' what the machines with a non-standard SSH port receive way less attention than the machines on the defaults.

[k_roy]

Yep. Because targeting 5k IPs is way harder than targeting all 4 billion

[justsomehnguy]

Guess you forgot what you was talking (and I was responding to) about the ports not addresses.