77.239.124.79

Attacks by type

Incidents by severity: Medium 3, Low 7

Incidents

These incidents come from 3 different servers. Each describes only its own history with this address, so a first ban on one can be a repeat ban on another.

• sshdServer 1LowAI verdict: malicious1 hitNov 4, 2026, 9:57 PM UTC

  Recidivist SSH credential-guessing from 77.239.124.79 (4 earlier bans in the recidive window) re-tripped shieldie-guard's sshd jail and drew a 57600s ban; it fits a pattern of rotating sources across [addr]/24, which suggests a coordinated but untargeted campaign rather than a host-specific attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 29, 2026, 7:46 PM UTC

  Recidivist SSH credential-guessing from 77.239.124.79 (6 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and got a 230400s ban. It fits the same automated campaign seen from several [addr]/24 hosts (.77, .63, .149), and no successful auth was observed.

• sshdServer 1LowAI verdict: malicious1 hitOct 28, 2026, 7:07 AM UTC

  same as 4010597d: Recidivist SSH credential-guessing from [addr] (1 earlier ban in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail and received a 7200s firewall ban; it matches recurring opportunistic scanning from the same [addr]/24 range (.36, .37, .63) and is not a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 26, 2026, 3:19 AM UTC

  Repeat SSH brute-force from 77.239.124.79 (second ban in the recidive window, part of the recurring [addr]/24 pattern) was contained by shieldie-guard's sshd jail with a 7200s firewall ban; consistent with opportunistic scanning rather than a targeted attack.

• sshdServer 2LowAI verdict: malicious1 hitOct 26, 2026, 2:19 AM UTC

  Repeated SSH auth failures from 77.239.124.79 tripped shieldie-guard's sshd jail, which applied a 3600s ban with no prior bans of this address; this is the fourth address from [addr]/24 jailed this month, which points to a persistent scanner rotating IPs within one subnet rather than a targeted attack.

• sshdServer 1LowAI verdict: malicious1 hitOct 25, 2026, 12:37 PM UTC

  same as 07e9aaa3: Recidivist SSH credential-guessing from [addr] (1 earlier ban in the recidive window) re-tripped shieldie-guard's sshd jail and was banned for 7200s; it fits a recurring pattern from the [addr]/24 range seen in prior incidents (.35, .80, .155), indicating opportunistic scanning from one netblock rather than a targeted attack.

• sshdServer 3MediumAI verdict: malicious1 hitOct 18, 2026, 1:29 AM UTC

  Recidivist SSH brute-force from 77.239.124.79 (3rd ban: 2 prior bans in the recidive window, refused attempts included), consistent with the recurring automated [addr]/24 campaign; shieldie-guard already applied a 14400s firewall ban.

• sshdServer 3MediumAI verdict: malicious1 hitOct 17, 2026, 11:29 PM UTC

  Recidivist SSH brute-force from 77.239.124.79 (1 prior ban in recidive window), consistent with the recurring [addr]/24 campaign; shieldie-guard already applied a 7200s firewall ban.

• sshdServer 3MediumAI verdict: malicious1 hitOct 17, 2026, 10:28 PM UTC

  SSH brute-force from 77.239.124.79 (first ban in the recidive window), consistent with the recurring automated [addr]/24 campaign seen in prior incidents; shieldie-guard applied a 3600s firewall ban.

• sshdServer 1LowAI verdict: malicious1 hitOct 16, 2026, 8:35 AM UTC

  Recidivist SSH credential-guessing from 77.239.124.79 (3 earlier bans in the recidive window, refused attempts included) re-tripped shieldie-guard's sshd jail, which applied a 28800s ban; it continues a sustained campaign from the same [addr]/24 range (.34, .37, .50) that looks like automated scanning, not a targeted attack.

Timeline

1. Nov 4, 2026, 10:00 PM UTCLast reported
2. Nov 4, 2026, 9:57 PM UTCsshd Low
3. Oct 29, 2026, 7:46 PM UTCsshd Low
4. Oct 28, 2026, 7:07 AM UTCsshd Low
5. Oct 26, 2026, 3:19 AM UTCsshd Low
6. Oct 26, 2026, 2:19 AM UTCsshd Low
7. Oct 25, 2026, 12:37 PM UTCsshd Low
8. Oct 18, 2026, 1:29 AM UTCsshd Medium
9. Oct 17, 2026, 11:29 PM UTCsshd Medium
10. Oct 17, 2026, 10:28 PM UTCsshd Medium
11. Oct 16, 2026, 8:35 AM UTCsshd Low
12. Sep 29, 2026, 8:25 PM UTCFirst reported