JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.104.79.240

149.104.79.240 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 83%: ?

83%

ISP	LIGHT NODE LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS154177
Domain Name	lightnode.com
Country	🇫🇷 France
City	Marseille, Provence-Alpes-Cote d'Azur

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.104.79.240

Whois 149.104.79.240

IP Abuse Reports for 149.104.79.240:

This IP address has been reported a total of 20 times from 15 distinct sources. 149.104.79.240 was first reported on October 21st 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 maxasp.net	2026-10-22 23:32:18 (5 hours ago)	F5 Connection Limit to atl-ssl1.maximtech.com 150 connections in consecutive seconds (Oldest Hit 10 ... show more F5 Connection Limit to atl-ssl1.maximtech.com 150 connections in consecutive seconds (Oldest Hit 10 seconds) show less	DDoS Attack
🇺🇸 TPI-Abuse	2026-10-22 22:46:41 (5 hours ago)	(mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 18:46:35.304201 2026] [security2:error] [pid 5847:tid 5847] [client 149.104.79.240:58759] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pinballhistory.com"] [uri "/wp-config.php"] [unique_id "atqSS7fxkqNvefprUX4mTgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Lee Daniel	2026-10-22 22:42:24 (6 hours ago)	149.104.79.240 - - [22/Oct/2026:18:42:23 -0400] "GET /c99.php HTTP/1.1" 403 6300 "-" "Mozilla/5.0 (L ... show more 149.104.79.240 - - [22/Oct/2026:18:42:23 -0400] "GET /c99.php HTTP/1.1" 403 6300 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36" ... show less	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-10-22 21:04:13 (7 hours ago)	Excessive 404/403 errors	Brute-Force
🇩🇪 Gwyneth Llewelyn	2026-10-22 21:03:39 (7 hours ago)	149.104.79.240 - - [22/Oct/2026:22:03:38 +0100] "GET /cgi-bin/index.php HTTP/2.0" 404 997 "-" "Mozil ... show more 149.104.79.240 - - [22/Oct/2026:22:03:38 +0100] "GET /cgi-bin/index.php HTTP/2.0" 404 997 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36" show less	Bad Web Bot
🇸🇬 naveeddaros	2026-10-22 20:29:54 (8 hours ago)	HTTP Flood DDoS attack detected	Brute-Force Bad Web Bot
🇺🇸 Awack	2026-10-22 18:33:48 (10 hours ago)	Webshell hunt on a WordPress site: 379 requests in 24h for wso.php, wp-wso.php, radio.php, chosen.ph ... show more Webshell hunt on a WordPress site: 379 requests in 24h for wso.php, wp-wso.php, radio.php, chosen.php, js.php, zone.php, xmrlpc.php and wp-config.php; blocked by Wordfence 292 times. show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-10-22 17:27:05 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 13:26:58.273425 2026] [security2:error] [pid 17448:tid 17468] [client 149.104.79.240:63221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ahsdistance.org"] [uri "/wp-config.php"] [unique_id "atpHYnqKPz40uKdDepTv1QAAARI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 EvilTurkey	2026-10-22 14:56:27 (13 hours ago)	Web app attack against financial institution website.	Web App Attack Hacking
🇫🇷 masterguru	2026-10-22 12:29:31 (16 hours ago)	Blocked scraper - old Chrome UA. Match of "rx (?i)(GoogleOther\|amazonbot\|bingbot\|googlebot\|yandexbot ... show more Blocked scraper - old Chrome UA. Match of "rx (?i)(GoogleOther\|amazonbot\|bingbot\|googlebot\|yandexbot\|duckduckbot\|OPR/\|Edg/\|EdgA/\|EdgiOS/\|Vivaldi/\|SamsungBrowser/\|YaBrowser/)" against "REQUEST_HEADERS:User-Agent" required. (780532-133) show less	Hacking
🇩🇪 Skyrider	2026-10-22 09:22:03 (19 hours ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
🇬🇧 abivia	2026-10-22 06:10:52 (22 hours ago)	Abivia WAF trigger: Rule scriptKiddies: Probing for vulnerabilities uri: /0.php	Hacking
🇺🇸 TPI-Abuse	2026-10-22 05:50:29 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:50:22.107337 2026] [security2:error] [pid 3865:tid 3865] [client 149.104.79.240:55695] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tulsatvmemories.com"] [uri "/wp-config.php"] [unique_id "atmkHopoly3JcwA6nBh9hwAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 02:05:38 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 149.104.79.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 22:05:32.523286 2026] [security2:error] [pid 19974:tid 19998] [client 149.104.79.240:57713] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dermatologycoloradosprings.com"] [uri "/wp-config.php"] [unique_id "atlvbP8-j5UKr_cxkXgI6AAAAFQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-10-22 01:01:07 (1 day ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 131.161.184.46

🇺🇸 45.45.238.81

🇺🇸 34.145.120.69

🇵🇭 2400:cb00:949:1000:58bf:e193:c384:a668

🇺🇸 2400:cb00:558:1000:899f:1ffd:ee5b:569e

🇪🇸 2400:cb00:40:1000:e8ab:2ad0:1daa:1a0f

🇧🇦 195.222.57.183

🇺🇸 192.253.209.19

🇧🇷 190.89.100.105

🇨🇴 190.66.65.111

🇳🇱 188.166.71.161

🇬🇧 185.247.137.126

🇺🇸 184.105.247.194

🇳🇱 138.226.239.233

🇺🇸 129.121.140.234

🇱🇰 124.43.71.117

🇺🇸 107.173.134.192

🇩🇪 102.220.163.181

🇺🇸 100.51.6.16

🇺🇸 72.214.65.13