109.160.32.169

Attacks by type

Incidents by severity: Medium 1, Low 7

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1LowAI verdict: malicious1 hitNov 5, 2026, 5:11 AM UTC

  109.160.32.169 re-tripped shieldie-guard's sshd jail with repeated SSH auth failures (5 earlier bans in recidive window, refused attempts included); it is part of a recurring [addr]/24 brute-force pattern, persistent automated noise rather than a targeted compromise, and already mitigated by a 115200s ban.

• sshdServer 1LowAI verdict: malicious1 hitNov 1, 2026, 5:58 PM UTC

  109.160.32.169 re-tripped shieldie-guard's sshd jail with repeated SSH auth failures (6 earlier bans in the recidive window, refused attempts included). This is persistent automated brute-force rather than a targeted attack, and it matches recent incidents from other addresses in [addr]/24.

• sshdServer 1LowAI verdict: malicious1 hitOct 20, 2026, 2:28 PM UTC

  Persistent SSH brute-force from 109.160.32.169 re-tripped shieldie-guard's sshd jail (6th ban, 5 prior in recidive window, refused attempts included) and is now under a 115200s firewall ban; this looks like automated recurring scanning rather than a targeted attack, consistent with prior verdicts.

• sshdServer 1LowAI verdict: malicious1 hitOct 18, 2026, 10:00 PM UTC

  109.160.32.169 re-tripped shieldie-guard's sshd jail with repeated SSH auth failures (4 earlier bans in the recidive window, refused attempts included) and received a 57600s firewall ban; this matches prior [path] activity from [addr], so it is persistent automated brute-force noise rather than a targeted attack.

• sshdServer 2MediumAI verdict: malicious1 hitOct 16, 2026, 2:37 PM UTC

  Repeated SSH auth failures from 109.160.32.169 matched shieldie-guard's 'sshd' jail and drew a 3600s ban; this source has no prior bans, but it sits in the same [addr]/24 range as several recidivist sources seen in past incidents, which suggests coordinated subnet-level brute-forcing rather than random noise.

• sshdServer 1LowAI verdict: malicious1 hitOct 14, 2026, 6:49 PM UTC

  109.160.32.169 is a repeat offender (3 earlier bans) re-tripping shieldie-guard's sshd jail, and is likely part of the same [addr]/24 brute-force pattern seen in prior incidents; this looks like persistent automated scanning, not a targeted compromise, and was contained by shieldie-guard's 28800s ban.

• sshdServer 3LowAI verdict: malicious1 hitOct 13, 2026, 5:27 PM UTC

  Repeated SSH auth failures from 109.160.32.169 tripped shieldie-guard's sshd jail (3600s firewall ban, no prior bans in the recidive window); this is the fourth address from [addr]/24 in recent incidents, which points to a rotating-IP scanning campaign from one subnet rather than a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 12, 2026, 4:40 PM UTC

  109.160.32.169 re-tripped shieldie-guard's sshd jail with repeated SSH auth failures (2 earlier bans in the recidive window) and received a 14400s ban. Several addresses in the same [addr]/24 range showed this pattern in prior incidents, which points to persistent automated brute-force from that range rather than a targeted attack.

Timeline

1. Nov 5, 2026, 5:14 AM UTCLast reported
2. Nov 5, 2026, 5:11 AM UTCsshd Low
3. Nov 1, 2026, 5:58 PM UTCsshd Low
4. Oct 20, 2026, 2:28 PM UTCsshd Low
5. Oct 18, 2026, 10:00 PM UTCsshd Low
6. Oct 16, 2026, 2:37 PM UTCsshd Medium
7. Oct 14, 2026, 6:49 PM UTCsshd Low
8. Oct 13, 2026, 5:27 PM UTCsshd Low
9. Oct 12, 2026, 4:40 PM UTCsshd Low
10. Oct 3, 2026, 2:04 AM UTCFirst reported