JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.143.137.21

Neutral Activity

Abuse Confidence Score

0% Low Risk

43 reports

19 reporters · latest 5 months ago

ISP: WiredISP Inc.
Usage Type: Fixed Line ISP
ASN: AS6079
Domain Name: wiredisp.com
Country: 🇺🇸 United States of America
City: Hershey, Pennsylvania

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.143.137.21 has been reported 43 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

43 from 19 distinct reporters

First reported

April 20th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-20 13:44:59 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 09:44:33.483022 2026] [security2:error] [pid 9825:tid 9825] [client 149.143.137.21:0] ModSe ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 09:44:33.483022 2026] [security2:error] [pid 9825:tid 9825] [client 149.143.137.21:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.env.toml"] [unique_id "ag26wYC9X0i75jTeoVxDUQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-19 14:53:08 UTC · (5 months ago)	(caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.137.21 - - [19/May/2026:14:53:03 +0000] "GET /.env.development. ... show more (caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.137.21 - - [19/May/2026:14:53:03 +0000] "GET /.env.development.local HTTP/1.1" [REDACTED] 200 2627 149.143.137.21 - - [19/May/2026:14:53:04 +0000] "GET /.env.example HTTP/1.1" [REDACTED] 200 2627 149.143.137.21 - - [19/May/2026:14:53:04 +0000] "GET /.env.swp HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [19/May/2026:14:53:04 +0000] "HEAD /.env.project HTTP/1.1" [REDACTED] 200 2627 149.143.137.21 - - [19/May/2026:14:53:04 +0000] "GET /.env.preview HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-17 17:04:25 UTC · (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 13:04:17.338971 2026] [security2:error] [pid 24740:tid 24740] [client 149.143.137.21:55343] ... show more (mod_security) mod_security (id:210730) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 13:04:17.338971 2026] [security2:error] [pid 24740:tid 24740] [client 149.143.137.21:55343] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bright-enterprise.com\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bright-enterprise.com"] [uri "/config/master.key"] [unique_id "agn1EaimgfPxyHjaoh8F5gAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:42:01 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:43.364758 2026] [security2:error] [pid 14442:tid 14458] [client 149.143.137.21:42725] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:41:43.364758 2026] [security2:error] [pid 14442:tid 14458] [client 149.143.137.21:42725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marinkovich.org"] [uri "/.env~"] [unique_id "agbcRzZRkVGYX_uH--qQZAAAAM0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 07:40:17 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:39:54.963385 2026] [security2:error] [pid 11972:tid 11972] [client 149.143.137.21:51675] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:39:54.963385 2026] [security2:error] [pid 11972:tid 11972] [client 149.143.137.21:51675] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cabwebs.com"] [uri "/.git/config"] [unique_id "agbNyg376qX0Wpgp7HJleQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 20:35:46 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 16:35:08.562764 2026] [security2:error] [pid 9050:tid 9050] [client 149.143.137.21:41171] M ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 16:35:08.562764 2026] [security2:error] [pid 9050:tid 9050] [client 149.143.137.21:41171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atelier92.com"] [uri "/.env.preview"] [unique_id "agOO_CBl4moOMVA_00CLoQAAAD0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 16:46:12 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 12:45:41.083492 2026] [security2:error] [pid 5333:tid 5333] [client 149.143.137.21:52703] M ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 12:45:41.083492 2026] [security2:error] [pid 5333:tid 5333] [client 149.143.137.21:52703] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.yuanwei.l3l4.com"] [uri "/.env.old"] [unique_id "agNZNcViQGh26znpT3XcTgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 13:53:15 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:52:45.449750 2026] [security2:error] [pid 13331:tid 13331] [client 149.143.137.21:52231] ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:52:45.449750 2026] [security2:error] [pid 13331:tid 13331] [client 149.143.137.21:52231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "peanutcarvings.com"] [uri "/.env.heroku"] [unique_id "agMwreJ59K1t7y4_4u4NKAAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-11 00:29:21 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 20:29:06.663418 2026] [security2:error] [pid 9345:tid 9345] [client 149.143.137.21:48071] M ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 20:29:06.663418 2026] [security2:error] [pid 9345:tid 9345] [client 149.143.137.21:48071] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bronislawsuchanek.com"] [uri "/.env.local"] [unique_id "agEi0pJV4ZXh2mR3jyyLSQAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 derester	2026-05-10 22:36:05 UTC · (6 months ago)	Forwarded traffic flood detected by MikroTik (threshold: >100 new connections/s, burst 1)	DDoS Attack
🇺🇸 TPI-Abuse	2026-05-10 21:13:22 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 17:13:10.894025 2026] [security2:error] [pid 6686:tid 6686] [client 149.143.137.21:38815] M ... show more (mod_security) mod_security (id:210492) triggered by 149.143.137.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 17:13:10.894025 2026] [security2:error] [pid 6686:tid 6686] [client 149.143.137.21:38815] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thedieselgroupllc.com"] [uri "/.env.production"] [unique_id "agD05oY4XXZ9TnI97j9TdQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-10 01:04:41 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.137.21 - - [10/May/2026:00:06:08 +0000] "HEAD /.env.old HTTP/1.1" ... show more (caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.137.21 - - [10/May/2026:00:06:08 +0000] "HEAD /.env.old HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [10/May/2026:00:06:08 +0000] "HEAD /.aws/credentials HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [10/May/2026:00:06:22 +0000] "HEAD /.env.test HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [10/May/2026:00:25:20 +0000] "HEAD /.env.production HTTP/1.1" [REDACTED] 200 2627 149.143.137.21 - - [10/May/2026:01:04:39 +0000] "GET /.env.swp HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 15:37:10 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:14:43:58 +0000] "HEAD /.env.int HTTP/1.1" ... show more (caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:14:43:58 +0000] "HEAD /.env.int HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:15:30:56 +0000] "HEAD /.aws/config HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:15:30:59 +0000] "HEAD /.git/config HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:15:30:59 +0000] "HEAD /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 149.143.137.21 - - [09/May/2026:15:37:07 +0000] "GET /.env.local.php HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 12:47:59 UTC · (6 months ago)	(caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.137.21 - - [09/May/2026:12:05:38 +0000] "GET /.env~ HTTP/1.1" [ ... show more (caddyscan) Scanner path probe from 149.143.137.21 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.137.21 - - [09/May/2026:12:05:38 +0000] "GET /.env~ HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:12:22:12 +0000] "HEAD /backend/.env HTTP/1.1" [REDACTED] 200 2627 149.143.137.21 - - [09/May/2026:12:47:57 +0000] "GET /phpmyadmin/ HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:12:47:57 +0000] "HEAD /.env.test HTTP/1.1" [REDACTED] 200 0 149.143.137.21 - - [09/May/2026:12:47:58 +0000] "HEAD /.env.prod HTTP/1.1" show less	Port Scan
🇬🇧 consul.to	2026-05-09 00:17:39 UTC · (6 months ago)	Web attack/malicious scanning detected	Web App Attack

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇦 185.106.244.111

🇳🇱 204.76.203.44

🇧🇷 187.120.24.95

🇵🇾 181.121.10.253

🇩🇪 167.94.146.57

🇧🇴 166.114.175.183

🇩🇪 91.40.147.4

🇧🇷 191.55.31.123

🇭🇰 165.154.73.93

🇵🇸 147.189.185.145

🇺🇸 74.235.106.65

🇰🇪 41.90.180.239

🇧🇪 207.175.218.17

🇳🇱 204.76.203.40

🇹🇷 185.231.227.166

🇸🇬 159.89.193.3

🇮🇹 147.161.244.85

🇨🇱 128.201.119.79

🇧🇩 103.143.139.151

🇮🇹 81.127.244.99