Looking forward to pulling some pf(4) stats.
I had a box hanging out there with nothing more than just a different sshd port (not for actual security, just less groper noise in the logs) with a year of log data on bots probing for accounts.
This evening I implemented geo-blocking anything that isn't from a domestic IP based on geoip data.
Now we wait a week or so, and then compare the $before to the $after volume of SSH probing attempts.