I actually caught a semi-real one once. My new employer was MITMing all ssh traffic.