70.54.182.130
On the shared blocklist: servers in the shieldie network block it.
Ban ends: Nov 7, 2026, 8:41 PM UTC
- Why
- AI analyst: SSH-only brute-forcer, three networks, active now, no subnet neighbours
- Attack types
sshd- First reported
- Sep 23, 2026, 1:38 PM UTC
- Last reported
- Nov 5, 2026, 4:41 AM UTC
- Network
- AS577 Bell Canada
- Location
- Canada
Attacks by type
| Attack type | Incidents |
|---|---|
sshd | 4 |
Incidents by severity: Medium 1, Low 3
Incidents
sshdMediumAI verdict: malicious1 hitNov 5, 2026, 4:39 AM UTCPersistent SSH brute-force from 70.54.182.130 tripped shieldie-guard's sshd jail again (6 prior bans in the recidive window, refused attempts included), and shieldie-guard applied an escalated 230400s firewall ban; this looks like a repeat-offender automated scanner rather than a confirmed targeted attack, but the persistence sets it apart from the prior first-offense noise.
sshdLowAI verdict: malicious1 hitOct 17, 2026, 1:04 AM UTCPersistent recidivist SSH credential-guessing from 70.54.182.130 (7th ban; 6 prior in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 230400s firewall ban; the pattern fits automated scanning, and nothing shown indicates a targeted attack or a successful login.
sshdLowAI verdict: malicious1 hitOct 14, 2026, 11:44 AM UTCPersistent recidivist SSH credential-guessing from 70.54.182.130 (6th ban; 5 prior in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 115200s firewall ban; consistent with prior verdicts, this is automated, persistent noise from one source, and the evidence shows no sign of a successful login or a targeted attack.
sshdLowAI verdict: malicious1 hitOct 12, 2026, 12:22 AM UTCPersistent recidivist SSH credential-guessing from 70.54.182.130 (5th ban; 4 prior in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 57600s firewall ban; this is consistent with prior verdicts of an automated, persistent single source and there is no evidence of a successful login.
Timeline
- Nov 5, 2026, 4:41 AM UTCLast reported
- Nov 5, 2026, 4:39 AM UTC
sshdMedium - Oct 17, 2026, 1:04 AM UTC
sshdLow - Oct 14, 2026, 11:44 AM UTC
sshdLow - Oct 12, 2026, 12:22 AM UTC
sshdLow - Sep 23, 2026, 1:38 PM UTCFirst reported
Shown: attack type, severity, AI verdict and a short redacted summary as reported by shieldie servers. Server names, addresses, user names and log lines are never published.