77.239.124.37

Attacks by type

Incidents by severity: Medium 2, Low 7

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1MediumAI verdict: malicious1 hitNov 5, 2026, 1:18 AM UTC

  Automated SSH brute-force from 77.239.124.37 (first ban, no prior recidive), part of the recurring [addr]/24 campaign seen in past incidents; shieldie-guard already applied a 3600s firewall ban.

• sshdServer 2LowAI verdict: malicious1 hitNov 4, 2026, 6:54 AM UTC

  same as 5d5460cd: Recidivist SSH credential-guessing from [addr] (2 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and received an escalated 14400s ban; the activity is consistent with persistent automated scanning from the [addr]/24 range (also seen from .67 and .36), not a targeted attack.

• sshdServer 3MediumAI verdict: malicious1 hitNov 3, 2026, 1:40 AM UTC

  77.239.124.37 tripped shieldie-guard's sshd jail again and got a 14400s ban, its third ban in the recidive window; past incidents show other hosts in [addr]/24 (.50, .63) doing the same, which points to a persistent coordinated brute-force source rather than one-off noise.

• sshdServer 2LowAI verdict: malicious1 hitOct 27, 2026, 4:20 AM UTC

  Recidivist SSH credential-guessing from 77.239.124.37 (3 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and received a 28800s ban; it matches the same [addr]/24 pattern seen in prior incidents, which points to persistent opportunistic scanning rather than a targeted attack.

• sshdServer 3LowAI verdict: malicious1 hitOct 20, 2026, 9:49 AM UTC

  Repeat SSH brute-force from 77.239.124.37 (second ban in the recidive window, same /24 as prior incidents from .207 and .146) was contained by shieldie-guard's sshd jail with a 7200s firewall ban; consistent with persistent opportunistic scanning from one subnet rather than a targeted attack.

• sshdServer 3LowAI verdict: malicious1 hitOct 20, 2026, 8:49 AM UTC

  Repeated SSH auth failures from 77.239.124.37 tripped shieldie-guard's sshd jail, which applied a 3600s ban with no prior bans of this address; this matches earlier opportunistic brute-force from other hosts in [addr]/24 (.207, .147, .151) rather than a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 15, 2026, 2:22 PM UTC

  Recidivist SSH credential-guessing from 77.239.124.37 (2 prior bans in the recidive window, refused attempts included), part of the same [addr]/24 range seen in earlier incidents, re-tripped shieldie-guard's sshd jail, which applied a 14400s firewall ban; this looks like persistent automated scanning, not a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 12, 2026, 9:04 AM UTC

  Recidivist SSH credential-guessing from 77.239.124.37 (1 prior ban in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 7200s firewall ban; this matches the repeated [addr]/24 pattern from past incidents (.31, .41, .149) and looks like persistent automated scanning from one subnet, not a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 12, 2026, 8:04 AM UTC

  same as 475205da: Recidivist SSH credential-guessing from [addr] (1 prior ban in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 7200s firewall ban; this matches recurring opportunistic scanning from the [addr]/24 range (also seen from .31 and .149) rather than a targeted attack.

Timeline

1. Nov 5, 2026, 1:22 AM UTCLast reported
2. Nov 5, 2026, 1:18 AM UTCsshd Medium
3. Nov 4, 2026, 6:54 AM UTCsshd Low
4. Nov 3, 2026, 1:40 AM UTCsshd Medium
5. Oct 27, 2026, 4:20 AM UTCsshd Low
6. Oct 20, 2026, 9:49 AM UTCsshd Low
7. Oct 20, 2026, 8:49 AM UTCsshd Low
8. Oct 15, 2026, 2:22 PM UTCsshd Low
9. Oct 12, 2026, 9:04 AM UTCsshd Low
10. Oct 12, 2026, 8:06 AM UTCFirst reported
11. Oct 12, 2026, 8:04 AM UTCsshd Low