JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.143.128.152

Neutral Activity

Abuse Confidence Score

0% Low Risk

38 reports

19 reporters · latest 5 months ago

ISP: WiredISP Inc.
Usage Type: Fixed Line ISP
ASN: AS6079
Domain Name: wiredisp.com
Country: 🇺🇸 United States of America
City: New York City, New York

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.143.128.152 has been reported 38 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

38 from 19 distinct reporters

First reported

April 20th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 raymarron.com	2026-05-21 19:39:13 UTC · (5 months ago)	/.env.production.local	Web App Attack
Anonymous	2026-05-19 08:10:39 UTC · (5 months ago)	(caddyscan) Scanner path probe from 149.143.128.152 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.128.152 - - [19/May/2026:08:10:33 +0000] "GET /.env.production ... show more (caddyscan) Scanner path probe from 149.143.128.152 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.128.152 - - [19/May/2026:08:10:33 +0000] "GET /.env.production.local HTTP/1.1" [REDACTED] 200 2627 149.143.128.152 - - [19/May/2026:08:10:33 +0000] "GET /.env.dev HTTP/1.1" [REDACTED] 200 2627 149.143.128.152 - - [19/May/2026:08:10:33 +0000] "GET /.env.old HTTP/1.1" [REDACTED] 200 2627 149.143.128.152 - - [19/May/2026:08:10:33 +0000] "GET /.env.save HTTP/1.1" [REDACTED] 200 2627 149.143.128.152 - - [19/May/2026:08:10:33 +0000] "GET /.env.testing HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-15 10:26:40 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 06:26:24.160398 2026] [security2:error] [pid 26942:tid 26942] [client 149.143.128.152:3417 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 06:26:24.160398 2026] [security2:error] [pid 26942:tid 26942] [client 149.143.128.152:34171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pappakotis.net"] [uri "/.env.production.local"] [unique_id "agb00HOm7tBg_yGl6lvdYAAAAC0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:57:37 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:57:26.879000 2026] [security2:error] [pid 10361:tid 10361] [client 149.143.128.152:5503 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:57:26.879000 2026] [security2:error] [pid 10361:tid 10361] [client 149.143.128.152:55033] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "accordionclub.org"] [uri "/.env.uat"] [unique_id "agbf9m-9-_uHHTHz40nbnAAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:42:17 UTC · (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:45.197881 2026] [security2:error] [pid 14442:tid 14456] [client 149.143.128.152:5150 ... show more (mod_security) mod_security (id:210730) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:45.197881 2026] [security2:error] [pid 14442:tid 14456] [client 149.143.128.152:51505] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|thebiglies.org\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thebiglies.org"] [uri "/db.sql"] [unique_id "agbcSTZRkVGYX_uH--qQuQAAAMs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:24:41 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:24:32.416973 2026] [security2:error] [pid 24279:tid 24279] [client 149.143.128.152:3799 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:24:32.416973 2026] [security2:error] [pid 24279:tid 24279] [client 149.143.128.152:37995] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crestrong.com"] [uri "/.git/config"] [unique_id "agbYQO74XJdAHt4N_lCgrAAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:03:51 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:03:00.858711 2026] [security2:error] [pid 12205:tid 12205] [client 149.143.128.152:5474 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:03:00.858711 2026] [security2:error] [pid 12205:tid 12205] [client 149.143.128.152:54745] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazinghydraulics.com"] [uri "/.env~"] [unique_id "agbTNLlhRwE6tp7bH1V4FAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 06:43:33 UTC · (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:42:30.940752 2026] [security2:error] [pid 13052:tid 13052] [client 149.143.128.152:5184 ... show more (mod_security) mod_security (id:210730) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:42:30.940752 2026] [security2:error] [pid 13052:tid 13052] [client 149.143.128.152:51843] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|callahan-co.com\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "callahan-co.com"] [uri "/config/master.key"] [unique_id "agbAVnSG5sV4J73Ff3DJJwAAACQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Progetto1	2026-05-12 22:05:02 UTC · (6 months ago)	Detected via HAProxyScanner at 2026-05-12 22:05:02 UTC on destination port WEB (80/443). Repeated scan / connection.	Port Scan Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-05-12 19:48:23 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:48:00.624636 2026] [security2:error] [pid 400:tid 400] [client 149.143.128.152:41089] M ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:48:00.624636 2026] [security2:error] [pid 400:tid 400] [client 149.143.128.152:41089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wryemusings.com"] [uri "/.env.development"] [unique_id "agOD8KEZAfOMAQ0CdpPnZgAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 12:46:10 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:45:46.816272 2026] [security2:error] [pid 19202:tid 19202] [client 149.143.128.152:5399 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.152 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:45:46.816272 2026] [security2:error] [pid 19202:tid 19202] [client 149.143.128.152:53995] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sheamar.com"] [uri "/.env.swp"] [unique_id "agMg-nTrjrCb9ke2W6iFmwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-09 10:02:54 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.128.152 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.152 - - [09/May/2026:10:02:50 +0000] "HEAD /.env.production H ... show more (caddyscan) Scanner path probe from 149.143.128.152 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.152 - - [09/May/2026:10:02:50 +0000] "HEAD /.env.production HTTP/1.1" [REDACTED] 200 2627 149.143.128.152 - - [09/May/2026:10:02:50 +0000] "GET /api/actuator/heapdump HTTP/1.1" [REDACTED] 200 0 149.143.128.152 - - [09/May/2026:10:02:50 +0000] "HEAD /.env.backup HTTP/1.1" [REDACTED] 200 0 149.143.128.152 - - [09/May/2026:10:02:50 +0000] "HEAD /wp-config.php.bak HTTP/1.1" [REDACTED] 200 0 149.143.128.152 - - [09/May/2026:10:02:50 +0000] "HEAD /backend/.env HTTP/1.1" show less	Port Scan
Anonymous	2026-05-08 13:39:00 UTC · (6 months ago)	DDoS web attack	DDoS Attack Brute-Force Web App Attack Hacking
🇫🇮 as211431.net	2026-05-08 06:07:49 UTC · (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/2 (HEAD method) Endpoint: /aws.env UA: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 This report was generated by: https://github.com/sefi ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/2 (HEAD method) Endpoint: /aws.env UA: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 Charlesiv	2026-05-08 04:00:52 UTC · (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 7029 (Windstream Communications LLC) Protocol: HTTP/2 (HEAD method) Endpoint: /.env.prod Timestamp: 2026-05-08T02:56:07Z Ray ID: 9f85307f4d140849 UA: Mozilla/5.0 (Windows NT ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 7029 (Windstream Communications LLC) Protocol: HTTP/2 (HEAD method) Endpoint: /.env.prod Timestamp: 2026-05-08T02:56:07Z Ray ID: 9f85307f4d140849 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 show less	Bad Web Bot

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2600:3c00::2000:2bff:fee9:f74f

🇩🇪 2001:4ca0:108:42:0:80:6:9

🇺🇸 184.105.139.92

🇫🇮 178.20.210.152

🇧🇷 168.228.18.130

🇨🇦 158.69.55.82

🇺🇸 152.32.150.26

🇮🇳 150.230.235.154

🇺🇸 147.90.234.14

🇳🇬 143.105.113.12

🇫🇷 104.165.131.140

🇳🇱 91.148.245.81

🇷🇺 89.111.180.243

🇨🇦 85.217.149.72

🇨🇦 85.217.149.63

🇨🇦 85.217.149.55

🇮🇩 69.5.20.205

🇺🇸 65.49.1.129

🇲🇳 59.153.112.145

🇳🇱 45.148.10.141