197.221.232.44

Attacks by type

Incidents by severity: Critical 2, Medium 2, Low 3

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1CriticalAI verdict: malicious5 hitsNov 11, 2026, 6:17 PM UTC
• sshdServer 1CriticalAI verdict: malicious6 hitsNov 11, 2026, 9:31 AM UTC
• sshdServer 1LowAI verdict: malicious5 hitsNov 8, 2026, 2:44 AM UTC

  Recidivist opportunistic SSH brute-force from 197.221.232.44 (3rd ban; 2 earlier bans in recidive window, refused attempts included) contained by shieldie-guard's sshd jail with a 14400s firewall ban; pattern matches untargeted noise seen previously.

• sshdServer 2MediumAI verdict: malicious1 hitNov 2, 2026, 7:39 AM UTC

  Recidivist SSH brute-force from 197.221.232.44 (2 prior bans in recidive window, previously analyzed 2026-10-25) again triggered shieldie-guard's 'sshd' jail and received a 14400s firewall ban; persistent automated campaign rather than a targeted attack, with no evidence of successful authentication.

• sshdServer 3LowAI verdict: malicious1 hitOct 28, 2026, 1:54 PM UTC

  Repeat SSH auth-failure burst from 197.221.232.44 (2nd ban; 1 prior ban in recidive window, refused attempts included) tripped shieldie-guard's sshd jail, which applied a 7200s firewall ban; consistent with opportunistic brute-force noise, not a targeted attack.

• sshdServer 2MediumAI verdict: malicious1 hitOct 25, 2026, 6:21 PM UTC

  Persistent recidivist SSH brute-force from 197.221.232.44 (3rd ban in recidive window, previously seen 2026-10-01 and 2026-10-05) matched shieldie-guard's 'sshd' jail, which applied a 14400s firewall ban; pattern indicates persistent automated scanning rather than a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 14, 2026, 10:19 PM UTC

  Persistent repeat offender 197.221.232.44 re-tripped shieldie-guard's sshd jail with repeated SSH auth failures (5 earlier bans in the recidive window), and shieldie-guard applied an escalated 115200s firewall ban; this looks like a persistent automated brute-force scanner rather than a targeted attack, with no evidence of a successful login.

Timeline

1. Nov 11, 2026, 6:19 PM UTCLast reported
2. Nov 11, 2026, 6:17 PM UTCsshd Critical
3. Nov 11, 2026, 9:31 AM UTCsshd Critical
4. Nov 8, 2026, 2:44 AM UTCsshd Low
5. Nov 2, 2026, 7:39 AM UTCsshd Medium
6. Oct 28, 2026, 1:54 PM UTCsshd Low
7. Oct 25, 2026, 6:21 PM UTCsshd Medium
8. Oct 14, 2026, 10:19 PM UTCsshd Low
9. Sep 23, 2026, 11:03 AM UTCFirst reported