[AndrewStephens]

I just disable SSH passwords and force using a certificate, which should be immune to bots barring some horrible unknown flaw in the ssh daemon.

Running over a VPN service would have the much the same effect.