This IP address has been reported a total of
11
times from
7 distinct
sources.
151.244.149.3 was first reported on
September 30th 2025 , and the most recent report was
16 hours ago France
with 1
report;
Russian Federation
with 1
report;
United States of America
with 1
report.
The most common categories in these recent reports were:
Hacking
2
times;
Bad Web Bot
2
times;
DDoS Attack
1
time;
Port Scan
1
time;
Web App Attack
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
2026-10-15 13:30:23
(16 hours ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /wishlist/index/add/product/10942/form_key/fREwOqh8ZEmuUHtu/ | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1; Trident/5.0) | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇫🇷
Entalpi.net
2026-10-12 10:39:42
(3 days ago)
Tried to hit sensible closed port commonly used in attacks
Port Scan
Hacking
🇺🇸
kosada.com
2026-08-18 13:23:46
(1 month ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-25 20:46:10
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
SMARTNET
2026-05-27 06:03:53
(4 months ago)
Aisuru(Mirai variant) DDoS | Incident ID: 05d1ccb8-9fe2-4914-b2a4-f363f4cb0b0e
DDoS Attack
🇦🇺
MAGIC
2026-04-20 01:16:31
(5 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-19 21:08:29
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 19 17:08:26.454498 2026] [security2:error] [pid 2495726:tid 2495726] [client 151.244.149.3:56632] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.silvermoonherbals.com|F|2"] [data ".moongoth.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.silvermoonherbals.com"] [uri "/www.moongoth.com"] [unique_id "aeVESiGWlQStlTbI76Ff1wAAAAM"], referer: https://www.silvermoonherbals.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-03-28 10:21:37
(6 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
🇺🇸
TPI-Abuse
2026-01-22 16:49:11
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 11:49:06.359833 2026] [security2:error] [pid 983637:tid 983637] [client 151.244.149.3:64677] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paulzaremba.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paulzaremba.com"] [uri "/[email protected] "] [unique_id "aXJVAgvCvidRYTWDhS9k8AAAAAE"], referer: http://www.paulzaremba.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 21:52:35
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 16:52:31.702288 2025] [security2:error] [pid 2294907:tid 2294907] [client 151.244.149.3:25970] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.techspertnet.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.techspertnet.com"] [uri "/[email protected] "] [unique_id "aVL4H3ebjH4wfvqTrnWYmQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 19:20:28
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 151.244.149.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 15:20:21.753696 2025] [security2:error] [pid 22646:tid 22646] [client 151.244.149.3:22080] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.scoutinsignia.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.scoutinsignia.com"] [uri "/WS_FTP.LOG"] [unique_id "aNwtddEzckXqFmOteHZjQAAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
11
of 11 reports
