shieldie.ai

211.251.245.88

Banned

On the shared blocklist: servers in the shieldie network block it.

Ban ends: Nov 6, 2026, 6:39 AM UTC

41
confidence (0-100)
3
independent servers
3
reporter networks
40
attempts
Why
AI analyst: SSH-only brute-forcing across three networks, no subnet activity
Attack types
sshd
First reported
Sep 20, 2026, 7:39 PM UTC
Last reported
Nov 4, 2026, 10:39 PM UTC
Network
AS4766 Korea Telecom
Location
South Korea

Attacks by type

Attack typeIncidents
sshd7

Incidents by severity: High 1, Medium 3, Low 3

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

  • sshdServer 1MediumAI verdict: malicious1 hitNov 4, 2026, 10:37 PM UTC

    Persistent recidivist 211.251.245.88 re-tripped shieldie-guard's sshd jail (5 earlier bans in recidive window, refused attempts included), now under a 115200s firewall ban; persistent automated SSH brute-force rather than evidence of a targeted compromise, as no successful auth was observed.

  • sshdServer 1MediumAI verdict: malicious1 hitOct 30, 2026, 9:11 PM UTC

    Persistent recidivist 211.251.245.88 re-tripped shieldie-guard's sshd jail (6th ban, 5 earlier in recidive window, refused attempts included); consistent with prior medium verdict — sustained SSH credential guessing, likely automated rather than specifically targeted, already contained by a 115200s nftables ban.

  • sshdServer 2LowAI verdict: malicious1 hitOct 26, 2026, 6:26 PM UTC

    Repeated SSH auth failures from 211.251.245.88 (0 prior bans in the recidive window) matched shieldie-guard's 'sshd' jail, which applied a 3600s firewall ban; consistent with opportunistic internet-wide brute-force noise rather than a targeted attack.

  • sshdServer 1MediumAI verdict: malicious1 hitOct 25, 2026, 3:15 PM UTC

    Persistent repeat offender 211.251.245.88 re-tripped shieldie-guard's sshd jail (5th ban, 4 earlier in the recidive window, refused attempts included), and shieldie-guard applied an escalated 57600s firewall ban; this looks like persistent automated SSH brute-forcing rather than a targeted attack.

  • sshdServer 3LowAI verdict: malicious1 hitOct 25, 2026, 6:45 AM UTC

    Repeat SSH brute-force from 211.251.245.88 (second ban, 1 prior in recidive window, attempts refused) was blocked by shieldie-guard's sshd jail with a 7200s escalated ban; consistent with opportunistic internet scanning, not a targeted attack.

  • sshdServer 1LowAI verdict: malicious1 hitOct 16, 2026, 1:31 PM UTC

    Recidivist 211.251.245.88 re-tripped shieldie-guard's sshd jail with repeated SSH auth failures (5th ban; 4 prior in recidive window, refused attempts included), consistent with persistent automated brute-force rather than a targeted attack; shieldie-guard applied a 57600s firewall ban.

  • sshdServer 3HighAI verdict: malicious1 hitOct 10, 2026, 11:52 PM UTC

Timeline

  1. Nov 4, 2026, 10:39 PM UTCLast reported
  2. Nov 4, 2026, 10:37 PM UTCsshd Medium
  3. Oct 30, 2026, 9:11 PM UTCsshd Medium
  4. Oct 26, 2026, 6:26 PM UTCsshd Low
  5. Oct 25, 2026, 3:15 PM UTCsshd Medium
  6. Oct 25, 2026, 6:45 AM UTCsshd Low
  7. Oct 16, 2026, 1:31 PM UTCsshd Low
  8. Oct 10, 2026, 11:52 PM UTCsshd High
  9. Sep 20, 2026, 7:39 PM UTCFirst reported

Shown: attack type, severity, AI verdict and a short redacted summary as reported by shieldie servers. Server names, addresses, user names and log lines are never published.

New search