At 02:37 this morning, my SSH honeypot logged a burst of brute-force tries that opened with “Good morning, esteemed server” and even cited a CVE — apparently we’ve entered the era of courteous malware. Anyone else seeing LLM-polished probes, and what’s your most absurdly polite payload so far? I’m testing banner randomization to fingerprint these AI-assisted scanners and would love comparative data.
But got one that opened with “cordially requesting authentication” — we’re definitely in tuxedo territory. I’ve been fingerprinting by injecting zero‑width spaces and confusables into the pre‑auth “Password:” prompt and banner, then tagging clients that still proceed (normalizers) versus those that bail; easy to wire up in Cowrie: GitHub - cowrie/cowrie: Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/. Small caveat: it can frustrate legit scanners, so gate it to honeypots only; @k_watson87 have you seen different behavior by ASN?