187.19.153.190

Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /brands/shopby/manufacturer-panasonic-rcf-lsi-xyz-fortinet-nvidia-ecler.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 | (Magento Site) show less

187.19.153.190 [1F88] 05:43:49 Authentication [IMAP] - Result=0, [email protected], Method=0 187.19.153.190 [2638] 05:43:52 Authentication [IMAP] - Result=0, [email protected], Method=0 187.19.153.190 [04A8] 05:43:58 Au ... show more 187.19.153.190 [1F88] 05:43:49 Authentication [IMAP] - Result=0, [email protected], Method=0 187.19.153.190 [2638] 05:43:52 Authentication [IMAP] - Result=0, [email protected], Method=0 187.19.153.190 [04A8] 05:43:58 Authentication [IMAP] - Result=0, [email protected], Method=0 ... show less

Imap or Submission login brute-force attacks.

Brute force attempt.

121 requests with url.path *.env

RdpGuard detected brute-force attempt on HTTP

CrowdSec: crowdsecurity/http-sensitive-files | req: /.env.local | 5 distinct paths | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love;

(caddyscan) Scanner path probe from 187.19.153.190 (BR/Brazil/187-19-153-190-temp-internal.static.brisanet.net.br): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 187.19.153.190 - - [29/Jul/2 ... show more (caddyscan) Scanner path probe from 187.19.153.190 (BR/Brazil/187-19-153-190-temp-internal.static.brisanet.net.br): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 187.19.153.190 - - [29/Jul/2026:09:59:47 +0000] "GET /.env.bak HTTP/1.1" [REDACTED] 200 2627 187.19.153.190 - - [29/Jul/2026:09:59:48 +0000] "GET /.env.tmp HTTP/1.1" [REDACTED] 200 2627 187.19.153.190 - - [29/Jul/2026:09:59:51 +0000] "GET /.env.swp HTTP/1.1" [REDACTED] 200 2627 187.19.153.190 - - [29/Jul/2026:09:59:52 +0000] "GET /.env~ HTTP/1.1" [REDACTED] 200 2627 187.19.153.190 - - [29/Jul/2026:09:59:55 +0000] "GET /.env.example HTTP/1.1" show less

Automated report (2026-07-29T00:55:58+08:00). Caught probing for env file.

[TueJul2813:06:20.1639912026][security2:error][pid59194:tid59288][client187.19.153.190:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOC ... show more [TueJul2813:06:20.1639912026][security2:error][pid59194:tid59288][client187.19.153.190:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"autodiscover.hdcadvisory.ch\"][uri\"/.env.prod\"][unique_id\"amiNLDz3MvKVzmCpRNXWUwAAABA\"] show less

DZBOT: Website Scanning / Scraping

Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124

(mod_security) mod_security triggered on hostname [redacted] 187.19.153.190 (BR/Brazil/187-19-153-190-temp-internal.static.brisanet.net.br)

(mod_security) mod_security (id:210492) triggered by 187.19.153.190 (187-19-153-190-temp-internal.static.brisanet.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 04:34:50.872490 2026] [security2:error] [ ... show more (mod_security) mod_security (id:210492) triggered by 187.19.153.190 (187-19-153-190-temp-internal.static.brisanet.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 04:34:50.872490 2026] [security2:error] [pid 2179736:tid 2179762] [client 187.19.153.190:38377] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bbpuertadelsol.com"] [uri "/.env"] [unique_id "amcYKkjEnfisSqj4rjTzawAAAFg"] show less

(mod_security) mod_security (id:210492) triggered by 187.19.153.190 (187-19-153-190-temp-internal.static.brisanet.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 01:47:49.293805 2026] [security2:error] [ ... show more (mod_security) mod_security (id:210492) triggered by 187.19.153.190 (187-19-153-190-temp-internal.static.brisanet.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 01:47:49.293805 2026] [security2:error] [pid 1542267:tid 1542267] [client 187.19.153.190:41313] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "zztp.ws"] [uri "/.env"] [unique_id "ambxBZZGgyu6Qr2Q8VuwgwAAAAI"] show less