JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.143.135.211

Neutral Activity

Abuse Confidence Score

0% Low Risk

50 reports

22 reporters · latest 5 months ago

ISP: WiredISP Inc.
Usage Type: Fixed Line ISP
ASN: AS6079
Domain Name: wiredisp.com
Country: 🇺🇸 United States of America
City: Hershey, Pennsylvania

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.143.135.211 has been reported 50 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

50 from 22 distinct reporters

First reported

April 20th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-23 22:41:30 UTC · (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 18:41:20.219728 2026] [security2:error] [pid 10047:tid 10090] [client 149.143.135.211:4734 ... show more (mod_security) mod_security (id:210730) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 18:41:20.219728 2026] [security2:error] [pid 10047:tid 10090] [client 149.143.135.211:47345] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.truthjusticecommission.aafm.us\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.truthjusticecommission.aafm.us"] [uri "/dump.sql"] [unique_id "ahItEEU5cQ82xCD3hA8ZUQAAANA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ITSNF	2026-05-16 12:30:06 UTC · (5 months ago)	Blocked by OPNsense firewall; 6 hits, proto=tcp, ports=443	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-05-15 08:06:56 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:06:38.879594 2026] [security2:error] [pid 5859:tid 5859] [client 149.143.135.211:36311] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:06:38.879594 2026] [security2:error] [pid 5859:tid 5859] [client 149.143.135.211:36311] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.uhfcfoundation.org.victorvictor.biz"] [uri "/.env.bak"] [unique_id "agbUDlJ-K2oXjbxe_aXsigAAACg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 06:43:25 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:42:31.549132 2026] [security2:error] [pid 12970:tid 12970] [client 149.143.135.211:5449 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:42:31.549132 2026] [security2:error] [pid 12970:tid 12970] [client 149.143.135.211:54493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "callahan-co.com"] [uri "/.env.release"] [unique_id "agbAV8-KxNm4_wHf0UgSigAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-05-15 04:04:13 UTC · (6 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 149.143.135.211 (US/United States/-): 1 in the last 3600 secs (0-197)	Hacking
🇺🇸 TPI-Abuse	2026-05-14 10:54:37 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 06:54:28.985060 2026] [security2:error] [pid 14175:tid 14175] [client 149.143.135.211:5029 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 06:54:28.985060 2026] [security2:error] [pid 14175:tid 14175] [client 149.143.135.211:50293] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jikishin-kai.org"] [uri "/.env.prod"] [unique_id "agWp5AQtNRpkRgVi_8OcWgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-13 08:42:28 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.211 - - [13/May/2026:07:56:16 +0000] "HEAD /.env HTTP/1.1" [R ... show more (caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.211 - - [13/May/2026:07:56:16 +0000] "HEAD /.env HTTP/1.1" [REDACTED] 200 0 149.143.135.211 - - [13/May/2026:08:00:14 +0000] "HEAD /.env~ HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [13/May/2026:08:09:27 +0000] "GET /api/actuator/env HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [13/May/2026:08:11:11 +0000] "GET /.env.local.php HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [13/May/2026:08:42:23 +0000] "GET /.env.secret HTTP/1.1" show less	Port Scan
🇺🇸 mnsf	2026-05-11 19:05:56 UTC · (6 months ago)	Too many Status 40X (12) Scanning/Probing (11)	Brute-Force Web App Attack
🇫🇷 dwmp	2026-05-11 10:01:28 UTC · (6 months ago)	Url probing: /.pgpass	Web App Attack
🇮🇳 Genhost	2026-05-11 09:41:12 UTC · (6 months ago)	SCANNING OF PHP SHELL FILES	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-11 04:52:22 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 00:52:08.343684 2026] [security2:error] [pid 27194:tid 27194] [client 149.143.135.211:4383 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 00:52:08.343684 2026] [security2:error] [pid 27194:tid 27194] [client 149.143.135.211:43831] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pizzadata.com"] [uri "/wp-config.php.bak"] [unique_id "agFgeAcxoyBHHx8YXbs3dgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 18:39:16 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:38:59.986344 2026] [security2:error] [pid 26258:tid 26258] [client 149.143.135.211:4707 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.135.211 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:38:59.986344 2026] [security2:error] [pid 26258:tid 26258] [client 149.143.135.211:47075] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "carepage.pro"] [uri "/.env.vault"] [unique_id "agDQwwfDIIZfG8DasFGyiAAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-10 16:37:15 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.211 - - [10/May/2026:16:09:19 +0000] "GET /actuator/heapdu ... show more (caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.211 - - [10/May/2026:16:09:19 +0000] "GET /actuator/heapdump HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [10/May/2026:16:35:15 +0000] "GET /.env.template HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [10/May/2026:16:35:17 +0000] "GET /.env.local.php HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [10/May/2026:16:37:08 +0000] "GET /.env.dev HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [10/May/2026:16:37:11 +0000] "GET /.env.development.local HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 19:23:14 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.211 - - [09/May/2026:18:45:09 +0000] "HEAD /root/.aws/credent ... show more (caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.211 - - [09/May/2026:18:45:09 +0000] "HEAD /root/.aws/credentials HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:18:46:16 +0000] "GET /.DS_Store HTTP/1.1" [REDACTED] 200 0 149.143.135.211 - - [09/May/2026:18:46:16 +0000] "HEAD /root/.aws/credentials HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:18:46:20 +0000] "GET /.env.development HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:19:23:13 +0000] "GET /.env.vault HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 07:51:22 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.211 - - [09/May/2026:07:44:19 +0000] "HEAD /.git/config HTTP/ ... show more (caddyscan) Scanner path probe from 149.143.135.211 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.211 - - [09/May/2026:07:44:19 +0000] "HEAD /.git/config HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:07:44:20 +0000] "GET /.env.bak HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:07:44:20 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:07:44:23 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 149.143.135.211 - - [09/May/2026:07:51:20 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇭 195.177.93.61

🇳🇱 181.215.115.186

🇭🇰 154.92.2.59

🇬🇧 154.16.44.88

🇺🇸 142.93.242.193

🇺🇸 129.121.103.78

🇨🇦 108.173.183.61

🇳🇱 81.19.216.94

🇺🇸 73.244.121.40

🇳🇱 35.214.151.36

🇫🇷 34.155.151.142

🇺🇸 23.236.71.46

🇵🇰 202.63.202.2

🇳🇱 77.239.124.69

🇩🇪 69.5.169.69

🇳🇱 35.214.222.143

🇧🇪 34.22.196.121

🇺🇸 172.59.122.78

🇺🇸 142.93.119.24

🇺🇸 68.225.58.245