this-is-not-an-attack: SSH probe username of security researcher? (opens in new tab)

I'm inclined to believe this is legitimate research - looking up the IP address seems to check out, it's at least assigned to "Technische Universitaet Muenchen". First probe I've seen that truthfully declares itself as non-threatening.