JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.100.113.49

157.100.113.49 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 30%: ?

30%

ISP	ECUANET - CORPORACION ECUATORIANA DE INFORMACION
Usage Type	Fixed Line ISP
ASN	AS27947
Domain Name	ecua.net.ec
Country	🇪🇨 Ecuador
City	Guayaquil, Guayas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.100.113.49

Whois 157.100.113.49

IP Abuse Reports for 157.100.113.49:

This IP address has been reported a total of 21 times from 10 distinct sources. 157.100.113.49 was first reported on February 11th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-10-24 00:03:29 (3 days ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-10-24 UTC.	Brute-Force Exploited Host
🇩🇪 ghostwarriors	2026-10-22 16:20:12 (4 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ksol-hostmaster	2026-10-22 15:55:51 (4 days ago)	2026/10/22 17:55:51 [error] 5197#128564: 244189 access forbidden by rule, client: 157.100.113.49, s ... show more 2026/10/22 17:55:51 [error] 5197#128564: 244189 access forbidden by rule, client: 157.100.113.49, server: new.hondaforum.hu, request: "GET /topic/szivo-tuning/907861/ HTTP/1.1", host: "new.hondaforum.hu" ... show less	Web Spam
🇺🇸 TPI-Abuse	2026-10-01 19:38:34 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 157.100.113.49 (host-157-100-113-49.ecua.net.ec ... show more (mod_security) mod_security (id:210350) triggered by 157.100.113.49 (host-157-100-113-49.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 15:38:28.557414 2026] [security2:error] [pid 26852:tid 26935] [client 157.100.113.49:51105] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|clinicadelparabrisas.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "clinicadelparabrisas.com"] [uri "/"] [unique_id "ar62tC-TyOmxq0EgfGtbowAAAUI"], referer: https://linktracker.space/dir/seo-growth-backlinks-41326 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-24 16:41:16 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 05:09:02 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-22 09:18:23 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 matt	2026-03-04 00:02:14 (7 months ago)	DDOS attack with query parameters attempting to overload WordPress site.	DDoS Attack
🇺🇸 TPI-Abuse	2026-03-03 10:54:15 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 157.100.113.49 (host-157-100-113-49.ecua.net.ec ... show more (mod_security) mod_security (id:210730) triggered by 157.100.113.49 (host-157-100-113-49.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 05:54:10.118766 2026] [security2:error] [pid 4055:tid 4055] [client 157.100.113.49:29672] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bahamascruisersguide.com\|F\|2"] [data ".blogspot.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bahamascruisersguide.com"] [uri "/Blogs-Websites/snowbirdscompassrose.blogspot.com"] [unique_id "aaa90sOt8mVB3RKwsRH-uwAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 SMARTNET	2025-11-30 18:38:00 (10 months ago)	Aisuru(Mirai variant) DDoS	DDoS Attack
🇩🇪 SMARTNET	2025-11-26 07:00:13 (11 months ago)	Aisuru(Mirai variant) DDoS	DDoS Attack
Anonymous	2025-11-25 05:45:17 (11 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-11-19 18:11:00 (11 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-11-15 15:24:02 (11 months ago)	scanning http requests from known botnet	Web App Attack
🇳🇱 exxos	2025-08-01 02:59:48 (1 year ago)	HTTP1.x attacks	DDoS Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.47.62.32

🇨🇳 118.186.18.243

🇺🇸 68.183.31.55

🇬🇧 57.128.190.44

🇳🇱 45.148.10.151

🇨🇳 39.105.108.6

🇨🇳 8.155.160.186

🇩🇪 167.94.146.72

🇷🇺 95.31.220.49

🇺🇸 91.230.168.219

🇵🇱 83.24.6.105

🇺🇸 50.6.111.141

🇳🇱 45.148.10.21

🇧🇷 35.198.1.42

🇹🇭 27.254.190.148

🇮🇱 2.55.122.202

🇭🇰 216.118.231.170

🇳🇱 138.226.239.53

🇩🇪 130.12.180.163

🇨🇳 123.13.50.189