thanks for the research -- so dos is not the only story indeed... and blocking the bots is of cause is worth while!  I still feel that it might be worth to not mix it with authentication-related regexes.  And anyone could still enable the sshd-ddos if they care about those (we could extend the comment that this is not only DoS but also exploit-related jail)