179.51.153.37
On the shared blocklist: servers in the shieldie network block it.
Ban ends: Nov 5, 2026, 10:59 PM UTC
- Why
- AI analyst: SSH-only brute-forcer across three networks, active now, no subnet spread
- Attack types
sshd- First reported
- Sep 23, 2026, 4:08 AM UTC
- Last reported
- Nov 4, 2026, 10:59 PM UTC
- Network
- AS271186 EUNAPOLIS TELECOM LTDA
- Location
- Brazil
Attacks by type
| Attack type | Incidents |
|---|---|
sshd | 3 |
Incidents by severity: Medium 1, Low 2
Incidents
These incidents come from 2 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.
sshdServer 1MediumAI verdict: malicious1 hitNov 4, 2026, 10:56 PM UTCRecidivist SSH brute-force from 179.51.153.37 (2 prior bans in the recidive window) matched shieldie-guard's 'sshd' jail and received a 14400s firewall ban. It is not in the [addr] seen in past incidents, so this looks like persistent automated scanning rather than a confirmed targeted campaign.
sshdServer 2LowAI verdict: malicious1 hitOct 12, 2026, 7:22 PM UTCPersistent recidivist SSH credential-guessing from 179.51.153.37 (4th ban; 3 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 28800s nftables ban; this is consistent with prior verdicts and looks like automated untargeted scanning, not a targeted attack, with no evidence of successful auth.
sshdServer 2LowAI verdict: malicious1 hitOct 11, 2026, 7:30 AM UTCRecidivist SSH credential-guessing from 179.51.153.37 (3rd ban; 2 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and drew a 14400s firewall ban. This matches the 2026-09-27 and 2026-10-04 incidents and looks like persistent opportunistic scanning, not a targeted attack; the evidence shows no successful auth.
Timeline
- Nov 4, 2026, 10:59 PM UTCLast reported
- Nov 4, 2026, 10:56 PM UTC
sshdMedium - Oct 12, 2026, 7:22 PM UTC
sshdLow - Oct 11, 2026, 7:30 AM UTC
sshdLow - Sep 23, 2026, 4:08 AM UTCFirst reported
Shown: attack type, severity, AI verdict and a short redacted summary as reported by shieldie servers. Server names, addresses, user names and log lines are never published.