There is just... SO MUCH... wrong with this.
@tfiebig I wouldn't call 21 hits within 24 hrs „brute force“ … not nice, but not brute force.

@atarifrosch It's the scans for the Catch-22 work (identifying compromised hosts via an SSH feature that lets you test whether a public key is installed or not. ;-))

This one: https://www.usenix.org/system/files/usenixsecurity25-munteanu.pdf

@tfiebig I am facing my palm.

For a long while now I've been thinking that technical organizations that have to deal with spurious / BS abuse reports should simply charge a processing fee against the frequent sources of these BS abuse reports.

After a second shitty report, they get an e-mail about what was shitty about it and that if these points are repeated in their next abuse report, they will be invoiced.

After the third, they get invoiced.

@rysiek I actually started to do that to a DMCA takedown thing. Only stopped after I cc'ed finance to ask for their invoice address, insisting that them continuing to send (repeated, timed out) reports after I told them the next one will be charged was essentially agreement to my terms.
@tfiebig @rysiek Yes, that's it! Instead of reporting a "brute force" [LOL], the original message should have said that the SSH probing was causing reports to be generated that required billable human intervention, and that any further probing was essentially agreement to their terms and would result in an invoice.
@alan @rysiek I am prertty sure that the probing did not cause human intervention in that case.

@tfiebig @rysiek Even if it did, usually there's a way to get on an exclusion list.

But still, I'd love to bill some of these AI scrapers...

@tfiebig if 21 times is considered a bruteforce...
@tfiebig Love how the replies so far are ignoring the elephant in the room. 🐘
@unixtippse WHICH ONE? 🤣 It is like one of those pictures that gets worse the longer you look at it.
@tfiebig No spoilers. 🤐
@unixtippse I am honestly not sure whteher _I_ already found all. ;-P
@tfiebig 139.19. That class b network will always be special for me...
@tfiebig i went “lmao” when i saw openclaw running as root

@niko And we have a winner. ;-P

Reply:

We are happy to honor your opt out request. For that, please

send us the output of:

ip a s

And add the following line to /root/.ssh/authorized_keys

ssh-ed25519 ...

With best regards,
NOC

@tfiebig @niko Did it work? In Minecraft, I mean...
@G33KatWork @niko Didn't try, too old for this shit (and not enough time to fuck with every bullshit i see. ;-P )