This IP address has been reported a total of
7
times from
5 distinct
sources.
157.100.104.218 was first reported on
December 30th 2023 , and the most recent report was
12 hours ago United States of America
with 2
reports;
Greece
with 1
report.
The most common categories in these recent reports were:
Web App Attack
2
times;
Brute-Force
2
times;
Bad Web Bot
2
times;
Port Scan
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-10-24 02:29:32
(12 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.100.104.218 (host-157-100-104-218.ecua.net. ...
show more
(mod_security) mod_security (id:210350) triggered by 157.100.104.218 (host-157-100-104-218.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 22:29:28.308362 2026] [security2:error] [pid 3943:tid 3943] [client 157.100.104.218:5868] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||theateroobleck.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "theateroobleck.com"] [uri "/"] [unique_id "atwYCOpcDbazeZkegB1OXQAAAAU"], referer: https://daytonology.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 23:39:12
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 157.100.104.218 (host-157-100-104-218.ecua.net. ...
show more
(mod_security) mod_security (id:210350) triggered by 157.100.104.218 (host-157-100-104-218.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 19:39:06.296864 2026] [security2:error] [pid 31319:tid 31319] [client 157.100.104.218:62127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||massingale.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "massingale.com"] [uri "/"] [unique_id "arMRmt5b_StWmCDeRcXMHgAAAAg"], referer: https://dapacheckerguest.online/dir/managed-link-building-131557
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-09-22 01:32:47
(1 month ago)
(mod_security) mod_security (id:11000011) triggered by 157.100.104.218 (EC/Ecuador/Guayas/Guayaquil/ ...
show more
(mod_security) mod_security (id:11000011) triggered by 157.100.104.218 (EC/Ecuador/Guayas/Guayaquil/-/[AS27947 Telconet S.A]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Sep 22 04:32:42.718499 2026] [security2:error] [pid 1957626:tid 1957718] [client 157.100.104.218:10245] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "ecua.net.ec" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: host-157-100-104-218.ecua.net.ec"] [severity "CRITICAL"] [hostname "ftiaxtomonosou.gr"] [uri "/wp-content/uploads/2019/01/%CE%91%CE%BD%CE%BF%CE%B9%CE%B3%CF%8C%CE%BC%CE%B5%CE%BD%CE%B7-%CE%9B%CE%B5%CF%85%CE%BA%CE%AE-300x218.jpg"] [unique_id "arHaun76fZ3dsWfznVjS7QAAANM"], referer: https://ftiaxtomonosou.gr/
show less
Port Scan
🇸🇪
KIDOS
2026-08-24 00:43:27
(2 months ago)
IIS malicious activity: sql_injection_attempt
Web App Attack
🇺🇸
hostseries
2024-06-17 17:58:30
(2 years ago)
Trigger: LF_DISTATTACK
Brute-Force
2024-06-10 02:54:43
(2 years ago)
Ports: 143,993; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
hostseries
2023-12-30 21:36:51
(2 years ago)
Trigger: LF_DISTATTACK
Brute-Force
Showing 1 to
7
of 7 reports
