> i imagine with knockd it would go negative.

So it's the people running knockd that are actually the ones generating all these ssh login attempts...