JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.143.136.251

Neutral Activity

Abuse Confidence Score

0% Low Risk

37 reports

15 reporters · latest 5 months ago

ISP: WiredISP Inc.
Usage Type: Fixed Line ISP
ASN: AS6079
Domain Name: wiredisp.com
Country: 🇺🇸 United States of America
City: Hershey, Pennsylvania

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.143.136.251 has been reported 37 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

37 from 15 distinct reporters

First reported

April 19th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-16 11:18:52 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 07:18:43.712977 2026] [security2:error] [pid 5637:tid 5637] [client 149.143.136.251:37589] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 07:18:43.712977 2026] [security2:error] [pid 5637:tid 5637] [client 149.143.136.251:37589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nadepot.nodepot.com"] [uri "/.env"] [unique_id "aghSkzrsKaccwN9NBr6slgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 15:19:49 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 11:19:41.025699 2026] [security2:error] [pid 12142:tid 12142] [client 149.143.136.251:5340 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 11:19:41.025699 2026] [security2:error] [pid 12142:tid 12142] [client 149.143.136.251:53405] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.db.ctemdr.com"] [uri "/.env.docker"] [unique_id "agc5jXBUbzwAfTLYTc0scAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:42:08 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:43.360706 2026] [security2:error] [pid 17846:tid 17902] [client 149.143.136.251:4167 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:43.360706 2026] [security2:error] [pid 17846:tid 17902] [client 149.143.136.251:41677] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebiglies.org"] [uri "/.git/config"] [unique_id "agbcR5QAhsgpo0NO44AwdgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:24:49 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:23:40.452811 2026] [security2:error] [pid 18001:tid 18001] [client 149.143.136.251:4555 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:23:40.452811 2026] [security2:error] [pid 18001:tid 18001] [client 149.143.136.251:45551] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "johnhansonmemorial.org.coolingsprings.org"] [uri "/wp-config.php.bak"] [unique_id "agbYDFL4133TGSqQAbBZ3wAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 ELYAZ	2026-05-13 09:15:04 UTC · (6 months ago)	(y3) Failed access -byebye- from 149.143.136.251 (US/United States/-): (CF_ENABLE)	Hacking
🇩🇪 FeG Deutschland	2026-05-12 12:10:14 UTC · (6 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 12	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 10:55:08 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 06:54:55.483439 2026] [security2:error] [pid 16048:tid 16048] [client 149.143.136.251:4834 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 06:54:55.483439 2026] [security2:error] [pid 16048:tid 16048] [client 149.143.136.251:48349] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "baird.net"] [uri "/.htpasswd"] [unique_id "agMG_4vPClHJbt-7oNEEKQAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-11 06:36:56 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.136.251 - - [11/May/2026:06:36:53 +0000] "GET /api/actuator/co ... show more (caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.136.251 - - [11/May/2026:06:36:53 +0000] "GET /api/actuator/configprops HTTP/1.1" [REDACTED] 200 0 149.143.136.251 - - [11/May/2026:06:36:53 +0000] "HEAD /app/.env HTTP/1.1" [REDACTED] 200 0 149.143.136.251 - - [11/May/2026:06:36:53 +0000] "HEAD /root/.aws/credentials HTTP/1.1" [REDACTED] 200 0 149.143.136.251 - - [11/May/2026:06:36:53 +0000] "HEAD /.aws/credentials HTTP/1.1" [REDACTED] 200 0 149.143.136.251 - - [11/May/2026:06:36:53 +0000] "HEAD /backend/.env HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-11 04:52:33 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 00:52:12.181072 2026] [security2:error] [pid 31191:tid 31191] [client 149.143.136.251:5205 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 00:52:12.181072 2026] [security2:error] [pid 31191:tid 31191] [client 149.143.136.251:52055] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pizzadata.com"] [uri "/.env.dist"] [unique_id "agFgfBMuzpFt3vMUsiJ65QAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 18:13:12 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:12:37.705437 2026] [security2:error] [pid 25575:tid 25575] [client 149.143.136.251:5772 ... show more (mod_security) mod_security (id:210730) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:12:37.705437 2026] [security2:error] [pid 25575:tid 25575] [client 149.143.136.251:57729] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.jamelrobinson.com\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.jamelrobinson.com"] [uri "/config/master.key"] [unique_id "agDKlQKph0km1hEy2nkBkQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-10 01:30:33 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.136.251 - - [10/May/2026:01:04:59 +0000] "HEAD /.env~ HTTP/1.1" [ ... show more (caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.136.251 - - [10/May/2026:01:04:59 +0000] "HEAD /.env~ HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [10/May/2026:01:30:29 +0000] "GET /.env.development.local HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [10/May/2026:01:30:30 +0000] "GET /.env.prod HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [10/May/2026:01:30:32 +0000] "GET /.env.orig HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [10/May/2026:01:30:32 +0000] "GET /.env.preview HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 04:05:44 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.136.251 - - [09/May/2026:04:05:34 +0000] "GET /.git/objects/ H ... show more (caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.136.251 - - [09/May/2026:04:05:34 +0000] "GET /.git/objects/ HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [09/May/2026:04:05:39 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [09/May/2026:04:05:39 +0000] "GET /.env.uat HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [09/May/2026:04:05:39 +0000] "GET /.env.default HTTP/1.1" [REDACTED] 200 2627 149.143.136.251 - - [09/May/2026:04:05:39 +0000] "GET /.env.development HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 01:35:44 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 6042200.wildcardprobe-1777274223773844929.bicities.org 200 2627 149.143.136.251 - - [09/Ma ... show more (caddyscan) Scanner path probe from 149.143.136.251 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 6042200.wildcardprobe-1777274223773844929.bicities.org 200 2627 149.143.136.251 - - [09/May/2026:00:36:01 +0000] "GET /.env.qa HTTP/1.1" mlwildcardprobe-1777273352273162956.mlkjidgfedcbimayz8765876103218ee1-d870-48a9-ac27-a7908a88c817.bicities.org 200 2627 149.143.136.251 - - [09/May/2026:00:55:28 +0000] "GET /.env.json HTTP/1.1" 987705326042wildcardprobe-1777099674053724881.bicities.org 200 0 149.143.136.251 - - [09/May/2026:01:08:07 +0000] "HEAD /wp-config.php HTTP/1.1" 987705326042wildcardprobe-1777099674053724881.bicities.org 200 2627 149.143.136.251 - - [09/May/2026:01:08:07 +0000] "GET /actuator/configprops HTTP/1.1" 4326042wildcardprobe-1777103739161464078.bicities.org 200 2627 149.143.136.251 - - [09/May/2026:01:35:39 +0000] "GET /actuator/heapdump HTTP/1.1" show less	Port Scan
🇺🇸 Penny Packer	2026-05-06 18:20:18 UTC · (6 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇺🇸 TPI-Abuse	2026-05-04 22:50:00 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 18:49:50.141066 2026] [security2:error] [pid 27991:tid 27991] [client 149.143.136.251:4017 ... show more (mod_security) mod_security (id:210492) triggered by 149.143.136.251 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 18:49:50.141066 2026] [security2:error] [pid 27991:tid 27991] [client 149.143.136.251:40179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kulwap.me.fydelity.net"] [uri "/.git/config"] [unique_id "afkiji0jaoRXLcGlFbKwDgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 195.178.110.94

🇵🇦 194.165.16.167

🇧🇷 179.61.154.105

🇨🇳 101.96.203.141

🇨🇦 85.217.149.65

🇺🇸 207.244.248.168

🇧🇷 170.81.201.231

🇺🇸 162.216.150.13

🇵🇱 162.158.102.240

🇧🇷 131.100.254.69

🇳🇱 86.38.187.168

🇵🇹 81.193.216.17

🇧🇾 37.215.39.133

🇴🇲 5.37.125.229

🇬🇧 195.140.214.22

🇧🇷 191.5.50.166

🇵🇱 162.158.102.154

🇫🇷 141.101.68.119

🇨🇳 117.50.46.117

🇺🇸 70.175.182.58