165.154.69.238

Attacks by type

Incidents by severity: Medium 2, Low 6

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1MediumAI verdict: malicious1 hitNov 5, 2026, 4:51 AM UTC

  Recidivist 165.154.69.238 (1 prior ban in the recidive window, refused attempts included; earlier shieldie-guard ban 2026-10-24) resumed repeated SSH auth failures matching the 'sshd' jail, and shieldie-guard applied an escalated 7200s firewall ban; this is consistent with persistent automated brute-force rather than a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 29, 2026, 6:32 AM UTC

  Repeat opportunistic SSH brute-force from 165.154.69.238 (2nd ban; prior 3600s ban on 2026-10-19) tripped shieldie-guard's sshd jail, which applied an escalated 7200s firewall ban; the pattern matches untargeted internet-wide scanning (same /16 seen before) rather than a targeted attack.

• sshdServer 3LowAI verdict: malicious1 hitOct 27, 2026, 9:49 PM UTC

  Recidivist SSH credential-guessing from 165.154.69.238 (3 earlier bans in the recidive window, refused attempts included), part of the recurring 165.154.x.x activity, re-tripped shieldie-guard's sshd jail and was firewall-banned for 28800s; this is persistent automated scanning, not a targeted attack.

• sshdServer 1MediumAI verdict: malicious1 hitOct 24, 2026, 5:38 PM UTC

  Repeated SSH auth failures from 165.154.69.238 (no prior bans in recidive window) matched shieldie-guard's 'sshd' jail, which applied a 3600s firewall ban; consistent with prior verdicts on the same [addr]/16 range, indicating ongoing opportunistic brute-force from that provider rather than a uniquely targeted attack.

• sshdServer 3LowAI verdict: malicious1 hitOct 22, 2026, 7:59 PM UTC

  Recidivist SSH credential-guessing from 165.154.69.238 (2 earlier bans in the recidive window, consistent with [path] incidents) re-tripped shieldie-guard's sshd jail and drew an escalated 14400s firewall ban; persistent automated scanning, not evidence of a targeted attack or compromise.

• sshdServer 2LowAI verdict: malicious1 hitOct 19, 2026, 6:35 AM UTC

  Repeated SSH auth failures from 165.154.69.238 tripped shieldie-guard's sshd jail, which applied a 3600s firewall ban with no prior bans of this address; this matches past opportunistic scanning from the [addr]/16 range rather than a targeted attack.

• sshdServer 3LowAI verdict: malicious1 hitOct 17, 2026, 2:07 PM UTC

  Repeat offender 165.154.69.238 (1 earlier ban, incl. 2026-10-16 first offense) re-tripped shieldie-guard's sshd jail with repeated SSH auth failures and was contained with an escalated 7200s firewall ban; pattern across 165.154.x.x addresses suggests opportunistic scanning from a single provider range rather than a targeted attack.

• sshdServer 3LowAI verdict: malicious1 hitOct 16, 2026, 6:00 AM UTC

  Repeated SSH auth failures from 165.154.69.238 (first offense, 0 prior bans in recidive window) tripped shieldie-guard's sshd jail and drew a 3600s firewall ban; consistent with opportunistic internet-wide brute-force noise from the same 165.154.x.x range seen in prior incidents, not a targeted attack.

Timeline

1. Nov 5, 2026, 4:55 AM UTCLast reported
2. Nov 5, 2026, 4:51 AM UTCsshd Medium
3. Oct 29, 2026, 6:32 AM UTCsshd Low
4. Oct 27, 2026, 9:49 PM UTCsshd Low
5. Oct 24, 2026, 5:38 PM UTCsshd Medium
6. Oct 22, 2026, 7:59 PM UTCsshd Low
7. Oct 19, 2026, 6:35 AM UTCsshd Low
8. Oct 17, 2026, 2:07 PM UTCsshd Low
9. Oct 16, 2026, 6:04 AM UTCFirst reported
10. Oct 16, 2026, 6:00 AM UTCsshd Low