JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.143.128.177

149.143.128.177 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 38%: ?

38%

ISP	WiredISP Inc.
Usage Type	Fixed Line ISP
ASN	AS7029
Domain Name	wiredisp.com
Country	🇺🇸 United States of America
City	Simi Valley, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.143.128.177

Whois 149.143.128.177

IP Abuse Reports for 149.143.128.177:

This IP address has been reported a total of 41 times from 17 distinct sources. 149.143.128.177 was first reported on April 19th 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-05-18 15:52:33 (3 weeks ago)	(caddyscan) Scanner path probe from 149.143.128.177 (US/United States/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 149.143.128.177 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.128.177 - - [18/May/2026:15:52:31 +0000] "GET /.env.aws HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [18/May/2026:15:52:31 +0000] "GET /.env.json HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [18/May/2026:15:52:31 +0000] "GET /.env.swp HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [18/May/2026:15:52:31 +0000] "GET /.env.testing HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [18/May/2026:15:52:31 +0000] "GET /.env.xml HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-15 08:48:20 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:48:09.086383 2026] [security2:error] [pid 14442:tid 14452] [client 149.143.128.177:53861] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.trident-environmental.com"] [uri "/.env.preview"] [unique_id "agbdyTZRkVGYX_uH--qaCgAAAMc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 07:39:33 (3 weeks ago)	(mod_security) mod_security (id:210730) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:39:25.516005 2026] [security2:error] [pid 32074:tid 32074] [client 149.143.128.177:49727] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bikinipageone.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bikinipageone.com"] [uri "/database.sql"] [unique_id "agbNrX12LsA9XE6QsqUFAgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 15:44:36 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 11:44:22.864266 2026] [security2:error] [pid 5850:tid 5918] [client 149.143.128.177:53487] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "promo.heworeblack.com"] [uri "/.env"] [unique_id "agXt1oKrrKYNSW4FcCKSDwAAAko"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 oisecnet	2026-05-13 21:01:14 (4 weeks ago)	Automated report: Unauthorized vulnerability scanning detected on 2026-05-13. 31 requests from this ... show more Automated report: Unauthorized vulnerability scanning detected on 2026-05-13. 31 requests from this IP. show less	Brute-Force Web App Attack SSH
Anonymous	2026-05-13 08:48:51 (4 weeks ago)	(caddyscan) Scanner path probe from 149.143.128.177 (US/United States/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 149.143.128.177 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:07:56:42 +0000] "GET /.env.production.local HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:08:16:58 +0000] "GET /server-status HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:08:17:01 +0000] "GET /.env.orig HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:08:38:00 +0000] "GET /actuator/env HTTP/1.1" [REDACTED] 200 0 149.143.128.177 - - [13/May/2026:08:48:48 +0000] "HEAD /wp-config.php HTTP/1.1" show less	Port Scan
Anonymous	2026-05-13 00:58:11 (4 weeks ago)	(caddyscan) Scanner path probe from 149.143.128.177 (US/United States/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 149.143.128.177 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.177 - - [13/May/2026:00:58:08 +0000] "HEAD /app/.env HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:00:58:09 +0000] "GET /.env.docker HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:00:58:09 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:00:58:09 +0000] "GET /.env.backup HTTP/1.1" [REDACTED] 200 2627 149.143.128.177 - - [13/May/2026:00:58:09 +0000] "GET /.env.test HTTP/1.1" show less	Port Scan
🇩🇪 Holger	2026-05-12 23:48:58 (4 weeks ago)	Bruteforce WebAttack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 20:37:41 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 16:37:27.080919 2026] [security2:error] [pid 14361:tid 14361] [client 149.143.128.177:56317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "urie.to.daveewalker.bz"] [uri "/backend/.env"] [unique_id "agOPh4yHL2CBGpYMOPQdHgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 11:09:52 (4 weeks ago)	(mod_security) mod_security (id:210730) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 07:09:47.978819 2026] [security2:error] [pid 13624:tid 13624] [client 149.143.128.177:55041] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|r-390.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "r-390.com"] [uri "/db.sql"] [unique_id "agMKe89uVAsYdQykPtO9DgAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Holger	2026-05-11 09:49:47 (1 month ago)	Bruteforce WebAttack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 18:14:31 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:14:23.646418 2026] [security2:error] [pid 6291:tid 6291] [client 149.143.128.177:50169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rpmevolution.com.jemsfood.com"] [uri "/.git/config"] [unique_id "agDK__omahUv75g8q0euYAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Bruce5051	2026-05-09 19:09:22 (1 month ago)	149.143.128.177 - - [09/May/2026:12:09:21 -0700] "GET /.env.sample HTTP/1.1" 301 162 "-" "Mozilla/5. ... show more 149.143.128.177 - - [09/May/2026:12:09:21 -0700] "GET /.env.sample HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0" ... show less	Hacking Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-09 01:39:18 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 21:39:00.467698 2026] [security2:error] [pid 22156:tid 22156] [client 149.143.128.177:43669] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "honeybeeplace.com.garyrankin.com"] [uri "/api/.env"] [unique_id "af6QNJAwHrqL3NaA67nKGgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-08 19:21:23 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 15:20:50.780100 2026] [security2:error] [pid 17492:tid 17492] [client 149.143.128.177:39631] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ficklepassionproductions.com"] [uri "/.env.demo"] [unique_id "af43kjeHorXcv45on0f8KwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.76

🇸🇬 165.225.112.134

🇫🇷 163.172.46.135

🇧🇷 138.97.221.178

🇭🇰 103.210.22.74

🇫🇷 84.46.247.185

🇪🇪 83.166.50.15

🇷🇴 80.94.92.182

🇨🇳 61.150.123.106

🇬🇧 35.203.211.85

🇻🇳 14.181.232.15

🇰🇷 220.127.148.6

🇧🇷 205.210.31.250

🇺🇸 205.201.184.15

🇳🇱 192.178.118.154

🇩🇪 161.35.65.86

🇦🇷 152.169.154.26

🇵🇭 136.158.101.109

🇮🇳 103.24.20.26

🇳🇱 81.19.216.83