Paramiko v4.0.0 (the latest) gets past the version string, it seems, but dies instantly on failed KEX, which is another convenient incompatibility. It does mean that even legitimate SSH bots in Python will fail though.

I am having fun playing with the slow syn flood of spoofed packets someone is sending. I appreciate them sending it. I like the variability in the TCP MSS, TTL, Window sizes they are sending.

Thus far I am letting some leak through.

    100 SYN received in 15.03 seconds

    100 SYN-ACK returned in 3 minutes and 22.03 seconds.

If the TCP Window size is abnormally small I block those and MSS outside of 1280-1460 but that is prior to anything the browser is doing. Those can been seen with

    tcpdump -p -i any -c512 -NNnnvv port 443 and 'tcp[13] == 2'

Or if a VPN is being used there is always a chance it is coming from a server/VPS provider and may be blackhole routed on my end.

That would be a "properly designed" bot and not a poorly-coded one

That is a good idea. My example is for people that expose ssh/sftp on purpose such as a public SFTP server for sharing who knows what.

Yeah I probably have a number of false positives from my semi-fascist nginx configuration [2] I just use this for hobby sites and would never be accepted as a commercially supported CDN. They do fancy detection methods whereas I just use simple hacky methods. I tend to tune things so my friends can get through and some random people may get dropped until I look at what they are sending. For what it's worth each method is entirely optional or tunable to a persons needs or fever dreams. Probably language settings.

[1] - https://mirror.newsdump.org/nginx/inc.d/30_generic_http_stuf...