77.239.124.31

Attacks by type

Incidents by severity: Critical 1, Medium 8, Low 2

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1CriticalAI verdict: malicious5 hitsNov 12, 2026, 4:28 AM UTC
• sshdServer 1LowAI verdict: malicious1 hitNov 5, 2026, 2:04 PM UTC

  Recidivist SSH credential-guessing from 77.239.124.31 (1 earlier ban in the recidive window) re-tripped shieldie-guard's sshd jail and was banned for 7200s; it matches a recurring pattern from the same [addr]/24 range, which points to [path] noise, not a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitNov 5, 2026, 1:04 PM UTC

  same as 61f1c738: Recidivist SSH credential-guessing from [addr] (2 earlier bans in the recidive window) re-tripped shieldie-guard's sshd jail and was banned for 14400s; it's part of a recurring pattern from the [addr]/24 range, consistent with automated scanning rather than a targeted attack.

• sshdServer 2MediumAI verdict: malicious1 hitOct 25, 2026, 10:01 AM UTC

  Persistent SSH brute-force from 77.239.124.31 (7th ban in recidive window, same [addr]/24 range as prior incidents, refused attempts included) tripped shieldie-guard's sshd jail, which applied a 230400s firewall ban; this is sustained, repeat-offender targeting of this host rather than one-off noise, but there is no evidence of a successful login.

• sshdServer 2MediumAI verdict: malicious1 hitOct 24, 2026, 2:00 AM UTC

  Persistent SSH brute-force from 77.239.124.31 (6th ban in the recidive window, part of a recurring campaign from [addr]/24) was blocked by shieldie-guard's sshd jail with a 115200s firewall ban; the attacker is persistent but there is no evidence of successful authentication.

• sshdServer 2MediumAI verdict: malicious1 hitOct 23, 2026, 10:00 AM UTC

  Persistent SSH brute-force from 77.239.124.31 (recidive: 4 earlier bans) within the recurring [addr]/24 source range; shieldie-guard's sshd jail applied a 57600s firewall ban. Persistent, host-focused automated attack rather than random noise, consistent with prior medium verdict.

• sshdServer 2MediumAI verdict: malicious1 hitOct 23, 2026, 1:59 AM UTC

  Repeat SSH brute-force from 77.239.124.31 (4th ban in recidive window, same [addr]/24 range as prior incidents) tripped shieldie-guard's sshd jail, which applied an escalated 28800s ban with attempts refused; persistent scanning, not evidence of a targeted compromise.

• sshdServer 2MediumAI verdict: malicious1 hitOct 22, 2026, 9:58 PM UTC

  Recidivist SSH brute force: 77.239.124.31 tripped shieldie-guard's sshd jail again and got a 14400s ban after 2 earlier bans in the recidive window, with attempts refused. The same [addr]/24 range has appeared in prior incidents (.207, .63), which points to a persistent automated campaign from one netblock rather than targeted compromise.

• sshdServer 3MediumAI verdict: malicious1 hitOct 20, 2026, 5:05 AM UTC

  Recidivist automated SSH brute-force from 77.239.124.31 (3rd ban: 2 prior bans in the recidive window, refused attempts included), consistent with the recurring [addr]/24 campaign; shieldie-guard applied a 14400s firewall ban.

• sshdServer 3MediumAI verdict: malicious1 hitOct 20, 2026, 3:05 AM UTC

  Recidivist automated SSH brute-force from 77.239.124.31 (1 prior ban in the recidive window, refused attempts included), consistent with the recurring [addr]/24 campaign; shieldie-guard's sshd jail applied a 7200s ban.

• sshdServer 3MediumAI verdict: malicious1 hitOct 20, 2026, 2:04 AM UTC

  Automated SSH brute-force from 77.239.124.31 (first ban, 0 prior in recidive window) consistent with the recurring [addr]/24 campaign; shieldie-guard applied a 3600s firewall ban.

Timeline

1. Nov 12, 2026, 4:30 AM UTCLast reported
2. Nov 12, 2026, 4:28 AM UTCsshd Critical
3. Nov 5, 2026, 2:04 PM UTCsshd Low
4. Nov 5, 2026, 1:04 PM UTCsshd Low
5. Oct 25, 2026, 10:01 AM UTCsshd Medium
6. Oct 24, 2026, 2:00 AM UTCsshd Medium
7. Oct 23, 2026, 10:00 AM UTCsshd Medium
8. Oct 23, 2026, 1:59 AM UTCsshd Medium
9. Oct 22, 2026, 9:58 PM UTCsshd Medium
10. Oct 20, 2026, 5:05 AM UTCsshd Medium
11. Oct 20, 2026, 3:05 AM UTCsshd Medium
12. Oct 20, 2026, 2:04 AM UTCsshd Medium
13. Sep 30, 2026, 6:04 AM UTCFirst reported