112.220.250.20

Attacks by type

Incidents by severity: Medium 1, Low 8

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 11:11 PM UTC

  Recidivist opportunistic SSH brute-force from 112.220.250.20 (7th ban, 6 earlier in recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and was banned for 230400s; the pattern matches prior untargeted noise rather than a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 29, 2026, 10:50 AM UTC

  Recidivist opportunistic SSH brute-force from 112.220.250.20 (6th ban, 5 earlier in recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and got a 115200s ban; consistent with prior noise-level verdicts, no sign of a targeted attack or a successful login.

• sshdServer 1LowAI verdict: malicious1 hitOct 28, 2026, 3:16 PM UTC

  Recidivist opportunistic SSH brute-force from 112.220.250.20 (5th ban: 4 earlier bans in recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 57600s nftables ban; persistent noise rather than a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 25, 2026, 10:17 PM UTC

  Recidivist opportunistic SSH brute-force from 112.220.250.20 (4th ban, 3 prior in recidive window, consistent with 2026-10-24 history) re-tripped shieldie-guard's sshd jail, which applied an escalated 28800s firewall ban; the evidence does not indicate a targeted attack or a successful login.

• sshdServer 1LowAI verdict: malicious1 hitOct 24, 2026, 6:08 PM UTC

  Recidivist opportunistic SSH brute-force from 112.220.250.20 (3rd ban, 2 prior in recidive window, consistent with [path] history) re-tripped shieldie-guard's sshd jail, which applied a 14400s escalated firewall ban; no evidence of successful auth or targeting.

• sshdServer 1LowAI verdict: malicious1 hitOct 17, 2026, 3:18 AM UTC

  Recidivist opportunistic SSH brute-force from 112.220.250.20 (1 prior ban in recidive window, consistent with its 2026-10-14 first ban) re-tripped shieldie-guard's sshd jail, which applied an escalated 7200s firewall ban; pattern indicates automated noise rather than a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 14, 2026, 12:50 AM UTC

  Repeated SSH auth failures from 112.220.250.20 tripped shieldie-guard's sshd jail, which applied a deterministic 3600s firewall ban; this is the address's first ban (no recidive), consistent with opportunistic internet-wide brute-force noise rather than a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 13, 2026, 12:37 PM UTC

  Repeated SSH auth failures from 112.220.250.20 tripped shieldie-guard's sshd jail, which applied a 3600s firewall ban; no earlier bans of this address in the recidive window, consistent with untargeted internet-wide brute-force noise seen in prior incidents.

• sshdServer 3MediumAI verdict: malicious1 hitOct 13, 2026, 12:36 PM UTC

  Recidivist SSH brute-force source 112.220.250.20 (1 prior ban in the recidive window, previously banned 2026-10-06) triggered shieldie-guard's 'sshd' jail again and received an escalated 7200s firewall ban; this pattern is persistent automated scanning, not a targeted attack.

Timeline

1. Nov 4, 2026, 11:12 PM UTCLast reported
2. Nov 4, 2026, 11:11 PM UTCsshd Low
3. Oct 29, 2026, 10:50 AM UTCsshd Low
4. Oct 28, 2026, 3:16 PM UTCsshd Low
5. Oct 25, 2026, 10:17 PM UTCsshd Low
6. Oct 24, 2026, 6:08 PM UTCsshd Low
7. Oct 17, 2026, 3:18 AM UTCsshd Low
8. Oct 14, 2026, 12:50 AM UTCsshd Low
9. Oct 13, 2026, 12:37 PM UTCsshd Low
10. Oct 13, 2026, 12:36 PM UTCsshd Medium
11. Oct 6, 2026, 10:02 AM UTCFirst reported