JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.143.131.30

Neutral Activity

Abuse Confidence Score

0% Low Risk

42 reports

18 reporters · latest 5 months ago

ISP: WiredISP Inc.
Usage Type: Fixed Line ISP
ASN: AS6079
Domain Name: wiredisp.com
Country: 🇺🇸 United States of America
City: Hershey, Pennsylvania

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.143.131.30 has been reported 42 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

42 from 18 distinct reporters

First reported

April 20th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-15 08:25:43 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:25:31.578814 2026] [security2:error] [pid 25294:tid 25294] [client 149.143.131.30:50571] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:25:31.578814 2026] [security2:error] [pid 25294:tid 25294] [client 149.143.131.30:50571] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wilsonclassof81.org"] [uri "/backend/.env"] [unique_id "agbYe4rEPtj0YUUxf7xr0AAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:00:51 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:00:26.748275 2026] [security2:error] [pid 29687:tid 29687] [client 149.143.131.30:50933] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:00:26.748275 2026] [security2:error] [pid 29687:tid 29687] [client 149.143.131.30:50933] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.scc1.us"] [uri "/.git/HEAD"] [unique_id "agbSmu6lBzfd5wyA25evPAAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 06:42:22 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:41:18.120927 2026] [security2:error] [pid 23348:tid 23348] [client 149.143.131.30:35201] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:41:18.120927 2026] [security2:error] [pid 23348:tid 23348] [client 149.143.131.30:35201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gods-law.com"] [uri "/.env.uat"] [unique_id "agbADs-r9EjaCCd8uxOUbQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 09:49:55 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 05:49:44.002799 2026] [security2:error] [pid 14725:tid 14792] [client 149.143.131.30:53187] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 05:49:44.002799 2026] [security2:error] [pid 14725:tid 14792] [client 149.143.131.30:53187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.absurdotron.com"] [uri "/wp-config.php"] [unique_id "agWauNQQnaujFV5mxSln4QAAAoo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 07:49:01 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 03:48:26.563868 2026] [security2:error] [pid 20649:tid 20649] [client 149.143.131.30:54961] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 03:48:26.563868 2026] [security2:error] [pid 20649:tid 20649] [client 149.143.131.30:54961] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mdp-interiors.com"] [uri "/.svn/entries"] [unique_id "agV-SoOjQL3Zv6pL7zlN0wAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-05-13 22:27:10 UTC · (5 months ago)		Brute-Force Web App Attack
Anonymous	2026-05-13 08:36:27 UTC · (5 months ago)	(caddyscan) Scanner path probe from 149.143.131.30 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.131.30 - - [13/May/2026:08:11:12 +0000] "GET /.env.example HTTP ... show more (caddyscan) Scanner path probe from 149.143.131.30 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.131.30 - - [13/May/2026:08:11:12 +0000] "GET /.env.example HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [13/May/2026:08:11:12 +0000] "GET /.env.uat HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [13/May/2026:08:14:39 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [13/May/2026:08:16:35 +0000] "GET /api/.env HTTP/1.1" [REDACTED] 200 0 149.143.131.30 - - [13/May/2026:08:36:25 +0000] "HEAD /app/.env HTTP/1.1" show less	Port Scan
🇩🇪 macrob	2026-05-13 06:50:56 UTC · (5 months ago)	2026/05/13 06:50:55 [error] 1193860#1193860: 223451128 access forbidden by rule, client: 149.143.131.30, server: binixo.ph, request: "HEAD /.env.production HTTP/2.0", host: "binixo.ph" 2026/05/13 06:50:55 [error] 1193860#1193860: 223451128 access f ... show more 2026/05/13 06:50:55 [error] 1193860#1193860: 223451128 access forbidden by rule, client: 149.143.131.30, server: binixo.ph, request: "HEAD /.env.production HTTP/2.0", host: "binixo.ph" 2026/05/13 06:50:55 [error] 1193860#1193860: 223451128 access forbidden by rule, client: 149.143.131.30, server: binixo.ph, request: "HEAD /server/api/.env HTTP/2.0", host: "binixo.ph" 2026/05/13 06:50:55 [error] 1193860#1193860: *223451128 access forbidden by rule, client: 149.143.131.30, server: binixo.ph, request: "HEAD /root/.netrc HTTP/2.0", host: "binixo.ph" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 19:38:38 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:38:21.911471 2026] [security2:error] [pid 18336:tid 18336] [client 149.143.131.30:38197] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:38:21.911471 2026] [security2:error] [pid 18336:tid 18336] [client 149.143.131.30:38197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scottcampbellconstruction.com"] [uri "/api/.env"] [unique_id "agOBrXy-A1JHI7bE8tu5sQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 13:53:08 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:52:39.367783 2026] [security2:error] [pid 12761:tid 12761] [client 149.143.131.30:40927] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:52:39.367783 2026] [security2:error] [pid 12761:tid 12761] [client 149.143.131.30:40927] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "peanutcarvings.com"] [uri "/app/.env"] [unique_id "agMwpxEovEUQlyULKHB_NQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 13:31:41 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:31:00.609790 2026] [security2:error] [pid 6699:tid 6699] [client 149.143.131.30:52883] M ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:31:00.609790 2026] [security2:error] [pid 6699:tid 6699] [client 149.143.131.30:52883] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lawrencehale.com"] [uri "/app/.env"] [unique_id "agMrlDlmtnzddRJyjzMG0AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-10 16:37:17 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.131.30 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:15:37:17 +0000] "GET /.env.production.l ... show more (caddyscan) Scanner path probe from 149.143.131.30 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:15:37:17 +0000] "GET /.env.production.local HTTP/1.1" [REDACTED] 200 0 149.143.131.30 - - [10/May/2026:16:37:06 +0000] "HEAD /.aws/config HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:16:37:12 +0000] "GET /.env.k8s HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:16:37:13 +0000] "GET /.env.2 HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:16:37:14 +0000] "GET /.env.azure HTTP/1.1" show less	Port Scan
Anonymous	2026-05-10 03:03:33 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.131.30 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:02:24:37 +0000] "GET /.env.old HTTP/1.1 ... show more (caddyscan) Scanner path probe from 149.143.131.30 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:02:24:37 +0000] "GET /.env.old HTTP/1.1" [REDACTED] 200 0 149.143.131.30 - - [10/May/2026:02:24:39 +0000] "HEAD /.aws/config HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:02:47:42 +0000] "GET /root/.aws/credentials HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:03:03:28 +0000] "GET /.env.vault HTTP/1.1" [REDACTED] 200 2627 149.143.131.30 - - [10/May/2026:03:03:29 +0000] "GET /.env.orig HTTP/1.1" show less	Port Scan
Anonymous	2026-05-10 00:26:17 UTC · (6 months ago)	149.143.131.30 - - [10/May/2026:00:26:16 +0000] "GET /admin/actuator HTTP/2.0" 404 1005 "https://ivonnesanchez.com/admin/actuator" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15 ... show more 149.143.131.30 - - [10/May/2026:00:26:16 +0000] "GET /admin/actuator HTTP/2.0" 404 1005 "https://ivonnesanchez.com/admin/actuator" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" "149.143.131.30" "-" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-09 22:01:50 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 18:01:24.737277 2026] [security2:error] [pid 18683:tid 18683] [client 149.143.131.30:43823] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.131.30 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 18:01:24.737277 2026] [security2:error] [pid 18683:tid 18683] [client 149.143.131.30:43823] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.old.renju.net"] [uri "/wp-config.php"] [unique_id "af-utGkRsVjKgpiAHKYjPQAAABg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇦 217.181.83.75

🇲🇦 196.115.145.185

🇨🇦 195.63.16.206

🇺🇸 188.221.223.101

🇺🇸 185.61.217.26

🇨🇳 183.217.3.82

🇺🇸 157.230.3.128

🇳🇱 138.226.239.234

🇻🇳 115.79.125.54

🇻🇳 103.228.36.189

🇳🇱 89.21.67.154

🇺🇸 66.240.236.119

🇺🇸 66.27.132.114

🇳🇱 64.205.72.82

🇺🇸 40.124.179.246

🇩🇪 34.159.85.73

🇷🇴 2.57.122.209

🇰🇷 1.238.106.229

🇳🇱 200.138.46.102

🇲🇦 196.118.47.74