69.6.221.18

Attacks by type

Incidents by severity: Medium 3, Low 5

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 10:06 PM UTC

  Recidivist opportunistic SSH credential scanning from 69.6.221.18 (3rd ban; 2 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a deterministic 14400s firewall ban; no evidence of successful auth or targeting.

• sshdServer 2MediumAI verdict: malicious1 hitNov 2, 2026, 4:46 PM UTC

  Persistent recidivist 69.6.221.18 (3 prior bans in recidive window, prior incidents 2026-10-24 and 2026-11-01) resumed repeated SSH auth failures and received a 28800s ban from shieldie-guard's 'sshd' jail; escalating persistence from the same source, with a neighboring address [addr] also seen, suggests a persistent automated campaign rather than random noise, though no successful login is evidenced.

• sshdServer 2MediumAI verdict: malicious1 hitNov 2, 2026, 7:32 AM UTC

  Persistent recidivist 69.6.221.18 (2 prior bans in the recidive window, 3rd incident since 2026-10-24) resumed repeated SSH auth failures matching shieldie-guard's 'sshd' jail and drew a deterministic 14400s firewall ban; the pattern indicates a persistent automated attacker repeatedly retrying this host, not a one-off, but there is no evidence of a successful login.

• sshdServer 2MediumAI verdict: malicious1 hitNov 1, 2026, 6:59 AM UTC

  Recidivist 69.6.221.18 (1 prior ban in the recidive window, refused attempts included; earlier incident 2026-10-24) resumed repeated SSH auth failures matching shieldie-guard's 'sshd' jail and received a deterministic 7200s firewall ban — persistent automated brute-force rather than one-off noise, with no evidence of successful login.

• sshdServer 1LowAI verdict: malicious1 hitOct 28, 2026, 9:09 AM UTC

  Recidivist opportunistic SSH credential scanning from 69.6.221.18 (2nd ban; 1 earlier ban in the recidive window, prior 3600s ban on 2026-10-25) re-tripped shieldie-guard's sshd jail, which applied an escalated 7200s firewall ban; consistent with untargeted noise, not a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 25, 2026, 9:08 AM UTC

  Repeated SSH auth failures from 69.6.221.18 tripped shieldie-guard's sshd jail, which applied a deterministic 3600s firewall ban; first ban for this address (0 recidive), consistent with opportunistic internet-wide brute-force noise rather than a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 24, 2026, 6:08 PM UTC

  Repeated SSH auth failures from first-time offender 69.6.221.18 (0 prior bans in the recidive window) matched shieldie-guard's 'sshd' jail and drew a deterministic 3600s firewall ban; the pattern looks like opportunistic scanning noise rather than a targeted attack, though a different 69.6.x.x address ([addr]) was banned on 2026-10-19.

• sshdServer 3LowAI verdict: malicious1 hitOct 21, 2026, 12:34 PM UTC

  Repeated SSH auth failures from 69.6.221.18 tripped shieldie-guard's sshd jail, which applied a 3600s firewall ban with no earlier bans of this address; consistent with opportunistic internet-wide brute-force noise rather than a targeted attack.

Timeline

1. Nov 4, 2026, 10:11 PM UTCLast reported
2. Nov 4, 2026, 10:06 PM UTCsshd Low
3. Nov 2, 2026, 4:46 PM UTCsshd Medium
4. Nov 2, 2026, 7:32 AM UTCsshd Medium
5. Nov 1, 2026, 6:59 AM UTCsshd Medium
6. Oct 28, 2026, 9:09 AM UTCsshd Low
7. Oct 25, 2026, 9:08 AM UTCsshd Low
8. Oct 24, 2026, 6:08 PM UTCsshd Low
9. Oct 21, 2026, 12:37 PM UTCFirst reported
10. Oct 21, 2026, 12:34 PM UTCsshd Low