For SSH I prefer blocklistd[0], which sadly is only available on FreeBSD and NetBSD AFAIK, it's a much simpler approach though requires a small patch to any daemons that want support.
Silly examples but the bots get confused. I admit these are not efficient rules. Try it out on that domain. Send some SSH bots my way, I honestly have no idea what it looks like on the bot-end-of-things. I would estimate about 95% of bots are libssh. About 4% are Go and the rest are an odd mix. That string can be spoofed but I think most people are too lazy.