Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[RoutePulse | 2026-11-04T02:41:12Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 190.5.42.135
EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — portal under siege (238 real failed logins / 15 min): 2 attacker IPs in 190.5.42.0/24 from campai ...
show more[RoutePulse | 2026-11-04T02:41:12Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 190.5.42.135
EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — portal under siege (238 real failed logins / 15 min): 2 attacker IPs in 190.5.42.0/24 from campaign AS27901 AS27901 - Pacifico Cable SPA. (246 IPs over the campaign); the attacker reuses its /24s nig · /24 aggregate member of 190.5.42.0/24
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
(dovecot_invalid_user) srv101 Dovecot login on non-existent account 190.5.42.135 (CL/Chile/host190.5.42.135.dynamic.pacificored.cl): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: Oct 23 11:42:45 dovecot[732]: i ...
show more(dovecot_invalid_user) srv101 Dovecot login on non-existent account 190.5.42.135 (CL/Chile/host190.5.42.135.dynamic.pacificored.cl): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: Oct 23 11:42:45 dovecot[732]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=[USERNAME] method=PLAIN, rip=190.5.42.135, lip=0.0.0.x, session=<40w8zX5eRV6+BSqH>
show less
