JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.143.128.201

Neutral Activity

Abuse Confidence Score

0% Low Risk

43 reports

21 reporters · latest 5 months ago

ISP: WiredISP Inc.
Usage Type: Fixed Line ISP
ASN: AS6079
Domain Name: wiredisp.com
Country: 🇺🇸 United States of America
City: New York City, New York

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.143.128.201 has been reported 43 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

43 from 21 distinct reporters

First reported

April 20th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-17 00:10:08 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 20:09:58.439423 2026] [security2:error] [pid 31512:tid 31512] [client 149.143.128.201:4573 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 20:09:58.439423 2026] [security2:error] [pid 31512:tid 31512] [client 149.143.128.201:45737] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "juliajimmy.com"] [uri "/app/.env"] [unique_id "agkHVrbqjeHrtkSKVVwgygAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-16 07:57:45 UTC · (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 03:57:33.661903 2026] [security2:error] [pid 24888:tid 24888] [client 149.143.128.201:4247 ... show more (mod_security) mod_security (id:210730) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 03:57:33.661903 2026] [security2:error] [pid 24888:tid 24888] [client 149.143.128.201:42475] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cook-islands-boat-registration.com\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cook-islands-boat-registration.com"] [uri "/config/master.key"] [unique_id "aggjbaBsIisCIA-vao0xHAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:42:20 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:43.339787 2026] [security2:error] [pid 30603:tid 30618] [client 149.143.128.201:3457 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:43.339787 2026] [security2:error] [pid 30603:tid 30618] [client 149.143.128.201:34577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.hg/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marinkovich.org"] [uri "/.hg/store"] [unique_id "agbcR1FNlHxSw_rKo9p_lAAAAIo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:24:18 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:23:38.040323 2026] [security2:error] [pid 18037:tid 18037] [client 149.143.128.201:4763 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:23:38.040323 2026] [security2:error] [pid 18037:tid 18037] [client 149.143.128.201:47635] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "johnhansonmemorial.org"] [uri "/wp-config.php.bak"] [unique_id "agbYCl2asu5wsA_HxeMWmwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 06:41:50 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:41:10.189823 2026] [security2:error] [pid 23045:tid 23045] [client 149.143.128.201:4757 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:41:10.189823 2026] [security2:error] [pid 23045:tid 23045] [client 149.143.128.201:47575] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gods-law.com"] [uri "/.git/HEAD"] [unique_id "agbABvc40RG5v7frpzxaowAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 07:49:17 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 03:48:50.757704 2026] [security2:error] [pid 22577:tid 22577] [client 149.143.128.201:5978 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 03:48:50.757704 2026] [security2:error] [pid 22577:tid 22577] [client 149.143.128.201:59787] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mdp-interiors.com"] [uri "/.env.release"] [unique_id "agV-Yu72iOdBUgVxjBbwdgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-13 08:00:36 UTC · (5 months ago)	(caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.201 - - [13/May/2026:07:56:37 +0000] "HEAD /.env.aws HTTP/1.1 ... show more (caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.201 - - [13/May/2026:07:56:37 +0000] "HEAD /.env.aws HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [13/May/2026:07:56:43 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 0 149.143.128.201 - - [13/May/2026:08:00:29 +0000] "HEAD /.env.qa HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [13/May/2026:08:00:31 +0000] "GET /.env.default HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [13/May/2026:08:00:32 +0000] "GET /.env.production HTTP/1.1" show less	Port Scan
Anonymous	2026-05-12 15:01:01 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.201 - - [12/May/2026:15:00:54 +0000] "HEAD /.env-sample HTTP/ ... show more (caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.201 - - [12/May/2026:15:00:54 +0000] "HEAD /.env-sample HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [12/May/2026:15:00:59 +0000] "GET /.env.live HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [12/May/2026:15:00:59 +0000] "GET /.env.vercel HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [12/May/2026:15:00:59 +0000] "GET /.env.stage HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [12/May/2026:15:00:59 +0000] "GET /.env.azure HTTP/1.1" show less	Port Scan
🇫🇷 masterguru	2026-05-11 13:13:02 UTC · (6 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 149.143.128.201 (US/United States/-): 1 in the last 3600 secs (0-195)	Hacking
🇫🇷 dwmp	2026-05-11 10:01:28 UTC · (6 months ago)	Url probing: /.env.backup	Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 18:14:35 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:14:23.674144 2026] [security2:error] [pid 4724:tid 4724] [client 149.143.128.201:51689] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.128.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:14:23.674144 2026] [security2:error] [pid 4724:tid 4724] [client 149.143.128.201:51689] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rpmevolution.com.jemsfood.com"] [uri "/.env.production"] [unique_id "agDK__D910eYCbHO0IdXZwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-09 15:31:04 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:14:47:29 +0000] "HEAD /.env.production H ... show more (caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:14:47:29 +0000] "HEAD /.env.production HTTP/1.1" [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:14:54:24 +0000] "HEAD /backend/.env HTTP/1.1" [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:15:13:17 +0000] "HEAD /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [09/May/2026:15:30:57 +0000] "GET /.aws/config HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [09/May/2026:15:30:59 +0000] "GET /api/actuator/env HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 06:45:00 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.128.201 - - [09/May/2026:06:14:26 +0000] "GET /.env.docker HTT ... show more (caddyscan) Scanner path probe from 149.143.128.201 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.128.201 - - [09/May/2026:06:14:26 +0000] "GET /.env.docker HTTP/1.1" [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:06:14:36 +0000] "HEAD /.env.testing HTTP/1.1" [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:06:40:48 +0000] "HEAD /api/.env HTTP/1.1" [REDACTED] 200 0 149.143.128.201 - - [09/May/2026:06:44:58 +0000] "HEAD /.env.local HTTP/1.1" [REDACTED] 200 2627 149.143.128.201 - - [09/May/2026:06:44:58 +0000] "GET /actuator/env HTTP/1.1" show less	Port Scan
🇫🇮 as211431.net	2026-05-08 18:38:26 UTC · (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: /.env.uat UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 This r ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: /.env.uat UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 Charlesiv	2026-05-08 04:01:11 UTC · (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 7029 (Windstream Communications LLC) Protocol: HTTP/1.1 (HEAD method) Endpoint: /.npmrc Timestamp: 2026-05-08T02:55:54Z Ray ID: 9f85302ebda2aa23 UA: Mozilla/5.0 (Macintosh; I ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 7029 (Windstream Communications LLC) Protocol: HTTP/1.1 (HEAD method) Endpoint: /.npmrc Timestamp: 2026-05-08T02:55:54Z Ray ID: 9f85302ebda2aa23 UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0 show less	Bad Web Bot

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2a03:2880:f800:16::

🇵🇰 210.56.19.224

🇳🇱 200.138.46.27

🇲🇦 197.146.146.83

🇺🇸 162.216.149.158

🇫🇷 157.173.114.66

🇺🇸 143.198.177.49

🇺🇸 134.122.125.153

🇧🇪 34.78.148.69

🇧🇪 34.76.33.44

🇨🇳 14.103.115.181

🇸🇪 13.60.162.251

🇰🇿 178.91.18.206

🇩🇪 167.94.146.46

🇺🇸 147.185.132.242

🇨🇳 120.48.57.228

🇲🇦 105.154.219.243

🇧🇩 103.203.179.148

🇵🇰 101.53.225.38

🇩🇪 51.195.6.20