And the second guess would be port 2222, so don't use it for a real ssh server!

I suspect that bots that randomly scan IP addresses for vulnerable hosts don't bother trying anything besides 22. I've been running my sshd on port 622 for a long time and I never get fishy connections (while I'd get at least one a week on port 22).

On the other hand a dedicated attacker who really wants to pwn your server will just scan all the ports and figure out what is listening and where. At this point you're better off implementing some form of port knocking if that's a cause for concern.

That being said, running sshd on port 2222 is probably not a good idea because it's not a privileged port.

Every machine I control has sshd listening on port 222 for that last reason.

I use 12345 as my SSH port (not really)