Re:AS13335 doing SSH scanning
by LinuxBender on Saturday September 25, 2021 @03:25PM
(#28655566)
Shodan scans a handful of common ports [1] but you are right, a targeted attack will not be stopped by moving ports. Along the lines of what jms703 mentioned, moving ports just removes the noise from the bots so you can have better alerting on real attacks and not suffer from alert fatigue.
[1] - https://en.wikipedia.org/wiki/Shodan_(website)