shieldie.ai

2.57.122.209

Banned

On the shared blocklist: servers in the shieldie network block it.

Ban ends: Nov 6, 2026, 7:34 AM UTC

45
confidence (0-100)
3
independent servers
3
reporter networks
40
attempts
Why
AI analyst: SSH-only brute-forcing, three victims, active now; subnet activity noted
Attack types
sshd
First reported
Sep 20, 2026, 9:10 AM UTC
Last reported
Nov 4, 2026, 11:36 PM UTC
Network
AS47890 UNMANAGED LTD
Location
Netherlands

Attacks by type

Attack typeIncidents
sshd7

Incidents by severity: Medium 2, Low 5

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

  • sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 11:31 PM UTC

    Recidivist opportunistic SSH credential scanning from 2.57.122.209 (3rd ban: 2 earlier in the recidive window, refused attempts included), same [addr]/24 range as prior incidents; shieldie-guard applied a 14400s firewall ban. This is noise-level scanning, not a targeted attack.

  • sshdServer 2LowAI verdict: malicious1 hitNov 4, 2026, 11:31 PM UTC

    Recidivist opportunistic SSH brute-force from 2.57.122.209 (3 earlier bans in the recidive window, recurring [addr]/24 range); contained by shieldie-guard's sshd jail with a 28800s nftables ban; it looks like noise, not a targeted attack.

  • sshdServer 3MediumAI verdict: malicious1 hitNov 4, 2026, 11:31 PM UTC

    SSH brute-force from 2.57.122.209 (first ban, 0 prior in recidive window) tripped shieldie-guard's 'sshd' jail and was banned for 3600s; source is in the recurring [addr]/24 range seen in prior incidents, consistent with opportunistic scanning rather than a targeted attack.

  • sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 5:26 AM UTC

    Recidivist opportunistic SSH credential scanning from 2.57.122.209 (2nd ban: 1 earlier in recidive window), same [addr]/24 range as prior incidents; shieldie-guard applied a 7200s firewall ban.

  • sshdServer 1LowAI verdict: malicious1 hitOct 26, 2026, 7:49 PM UTC

    Recidivist opportunistic SSH credential scanning from 2.57.122.209 (2nd ban: 1 earlier in the recidive window, refused attempts included), consistent with prior scanning from the same [addr]/24 range, already mitigated by shieldie-guard's 7200s firewall ban.

  • sshdServer 2MediumAI verdict: malicious1 hitOct 14, 2026, 11:40 PM UTC

    2.57.122.209 tripped shieldie-guard's sshd jail again and received a 115200s firewall ban; with 5 earlier bans in the recidive window and repeated hits from other 2.57.122.x addresses, this is a persistent automated brute-force campaign from one network, with no evidence of a successful login.

  • sshdServer 1LowAI verdict: malicious1 hitOct 4, 2026, 7:09 AM UTC

    Recidivist opportunistic SSH credential scanning from 2.57.122.209 (9th ban: 8 earlier in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 921600s firewall ban; consistent with the same [addr]/24 scanning pattern seen in prior incidents, not a targeted attack.

Timeline

  1. Nov 4, 2026, 11:36 PM UTCLast reported
  2. Nov 4, 2026, 11:31 PM UTCsshd Low
  3. Nov 4, 2026, 11:31 PM UTCsshd Low
  4. Nov 4, 2026, 11:31 PM UTCsshd Medium
  5. Nov 4, 2026, 5:26 AM UTCsshd Low
  6. Oct 26, 2026, 7:49 PM UTCsshd Low
  7. Oct 14, 2026, 11:40 PM UTCsshd Medium
  8. Oct 4, 2026, 7:09 AM UTCsshd Low
  9. Sep 20, 2026, 9:10 AM UTCFirst reported

Shown: attack type, severity, AI verdict and a short redacted summary as reported by shieldie servers. Server names, addresses, user names and log lines are never published.

New search