beware of distributed brute-forcing

An interesting article about distributed brute-forcing by bad guys - 

https://bsdly.blogspot.com/2013/10/the-hail-mary-cloud-and-lessons-learned.html

So, for SSH we can use key-based auth for protection, and it would be safer to use two-factor auth for other things like wordpress.