JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

149.202.85.141

Neutral Activity

Abuse confidence score ?

0% Low Risk

29 reports

23 reporters · latest 1 year ago

ISP	OVH SAS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Hostname(s)	ns3624517.ip-149-202-85.eu
Domain Name	ovh.net
Country	🇫🇷 France
City	Lille, Hauts-de-France

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

149.202.85.141 has been reported 29 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 149.202.85.141

This IP address has been reported a total of 29 times from 23 distinct sources. 149.202.85.141 was first reported on August 19th 2025, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2025-08-20 21:51:13 (1 year ago)	Kingcopy(AI-IDS): IP is wandering around the site and acting suspiciously.	Bad Web Bot
🇺🇸 Penny Packer	2025-08-19 22:24:56 (1 year ago)	Fail2Ban apache-tripwires	Web App Attack
🇨🇭 lufi	2025-08-19 22:24:54 (1 year ago)	2025-08-20T00:24:53+02:00 lufischer04 ids442 2025-08-20 00:24:53 149.202.85.141: blacklisted Pattern ... show more 2025-08-20T00:24:53+02:00 lufischer04 ids442 2025-08-20 00:24:53 149.202.85.141: blacklisted Pattern: /sftp.json ... show less	Web Spam Hacking Brute-Force Web App Attack
🇺🇸 technojoe99	2025-08-19 21:33:18 (1 year ago)	Exploit scan from 149.202.85.141. GET /sftp.json HTTP/1.1.	Web App Attack
🇦🇺 FSB.ru - Is it?	2025-08-19 20:36:36 (1 year ago)	Brute force login for user accounts	Brute-Force Web App Attack
🇺🇸 sabrinagoom	2025-08-19 20:29:19 (1 year ago)	Triggered WAF (firewallManaged) from FR Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: ... show more Triggered WAF (firewallManaged) from FR Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: /sftp-config.json UA: http://Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2025-08-19 20:29:01 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 149.202.85.141 (ns3624517.ip-149-202-85.eu): 1 ... show more (mod_security) mod_security (id:210492) triggered by 149.202.85.141 (ns3624517.ip-149-202-85.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 19 16:28:53.283094 2025] [security2:error] [pid 14744:tid 14744] [client 149.202.85.141:56256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lahamradio.com"] [uri "/sftp-config.json"] [unique_id "aKTehe9IepXOZHzYFKDpMAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-08-19 17:05:42 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 149.202.85.141 (ns3624517.ip-149-202-85.eu): 1 ... show more (mod_security) mod_security (id:210492) triggered by 149.202.85.141 (ns3624517.ip-149-202-85.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 19 13:05:33.850427 2025] [security2:error] [pid 27484:tid 27484] [client 149.202.85.141:54260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "restaurantfixture.com"] [uri "/sftp-config.json"] [unique_id "aKSu3aefNxbzdU-UJUiCwAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 nzhost.co.nz	2025-08-19 16:05:12 (1 year ago)	$f2bV_matches	Hacking Brute-Force
🇫🇮 as211431.net	2025-08-19 15:57:36 (1 year ago)	Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.vscode/ftp-sync.json UA: http://Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 jcbriar	2025-08-19 15:57:10 (1 year ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇺🇸 MogBox	2025-08-19 15:33:20 (1 year ago)	(RSRCTROLL) Vulnerability Trolling: GET/POST /sftp-config.json 149.202.85.141 (FR/France/ns3624517.i ... show more (RSRCTROLL) Vulnerability Trolling: GET/POST /sftp-config.json 149.202.85.141 (FR/France/ns3624517.ip-149-202-85.eu): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 149.202.85.141 - - [19/Aug/2025:11:33:10 -0400] "GET /sftp-config.json HTTP/2.0" 404 167 "http://mogs.lol/sftp-config.json" "http://Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.2.1" show less	Hacking
🇺🇸 TPI-Abuse	2025-08-19 15:04:19 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 149.202.85.141 (ns3624517.ip-149-202-85.eu): 1 ... show more (mod_security) mod_security (id:210492) triggered by 149.202.85.141 (ns3624517.ip-149-202-85.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 19 11:04:12.663908 2025] [security2:error] [pid 27694:tid 27694] [client 149.202.85.141:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aslanhan.com"] [uri "/sftp-config.json"] [unique_id "aKSSbNhi_8KbJroZIJv9nQAAABQ"], referer: http://aslanhan.com/sftp-config.json show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Starburst SysOp Team	2025-08-19 14:43:52 (1 year ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-mnz6-3)	Hacking Web App Attack
Anonymous	2025-08-19 14:33:53 (1 year ago)	Ports: *; Direction: 0; Trigger: CT_LIMIT	Brute-Force SSH

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 193.25.6.249

🇨🇳 118.145.107.219

🇩🇪 95.90.13.168

🇺🇸 71.6.239.166

🇯🇵 35.221.79.239

🇰🇷 211.193.120.98

🇵🇱 193.25.7.48

🇮🇳 122.175.49.124

🇭🇰 118.141.86.13

🇵🇰 118.107.139.224

🇮🇩 114.6.128.61

🇺🇸 71.6.239.12

🇺🇸 71.6.239.10

🇺🇸 65.49.1.181

🇪🇹 196.189.56.78

🇺🇦 193.107.171.41

🇵🇱 193.25.7.4

🇷🇺 151.252.84.225

🇨🇳 117.91.186.55

🇨🇳 117.50.51.198