shieldie.ai

66.116.224.33

Reported

Reported, waiting for confirmation by more independent servers.

34
confidence (0-100)
2
independent servers
2
reporter networks
27
attempts
Why
AI analyst: Ordinary SSH brute-forcer across 3 networks, single service, no subnet activity
Attack types
sshd
First reported
Sep 20, 2026, 9:10 AM UTC
Last reported
Nov 4, 2026, 5:19 PM UTC
Network
AS31898 Oracle Corporation
Location
India

Attacks by type

Attack typeIncidents
sshd4

Incidents by severity: Low 4

Incidents

These incidents come from 2 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

  • sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 5:18 PM UTC

    Persistent automated SSH brute-force from 66.116.224.33 (4th ban, 3 prior in recidive window) was contained by shieldie-guard's sshd jail with an escalated 28800s firewall ban; the pattern looks like repeat opportunistic scanning rather than a targeted attack, and the evidence shows no successful login.

  • sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 2:41 AM UTC

    Persistent SSH brute-force from 66.116.224.33 (4th ban, 3 prior in recidive window) was contained by shieldie-guard's sshd jail with an escalated 28800s firewall ban. It fits a recurring pattern from the [addr]/16 range and is likely automated, not targeted; there is no evidence of a successful login.

  • sshdServer 2LowAI verdict: malicious1 hitNov 1, 2026, 10:57 AM UTC

    Untargeted SSH brute-force noise from 66.116.224.33 (0 prior bans in the recidive window; recurring 66.116.x.x range seen in prior incidents) matched shieldie-guard's 'sshd' jail, which applied a deterministic 3600s firewall ban.

  • sshdServer 1LowAI verdict: malicious1 hitOct 14, 2026, 2:55 PM UTC

    Persistent recidivist SSH credential-guessing from 66.116.224.33 (7th ban, 6 prior in recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and was blocked with a 230400s firewall ban; the pattern matches ongoing opportunistic scanning from the [addr]/16 range, not a targeted compromise.

Timeline

  1. Nov 4, 2026, 5:19 PM UTCLast reported
  2. Nov 4, 2026, 5:18 PM UTCsshd Low
  3. Nov 4, 2026, 2:41 AM UTCsshd Low
  4. Nov 1, 2026, 10:57 AM UTCsshd Low
  5. Oct 14, 2026, 2:55 PM UTCsshd Low
  6. Sep 20, 2026, 9:10 AM UTCFirst reported

Shown: attack type, severity, AI verdict and a short redacted summary as reported by shieldie servers. Server names, addresses, user names and log lines are never published.

New search