JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.100.199.3

157.100.199.3 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 44%: ?

44%

ISP	ECUANET - CORPORACION ECUATORIANA DE INFORMACION
Usage Type	Fixed Line ISP
ASN	AS27947
Hostname(s)	host-157-100-199-3.ecua.net.ec
Domain Name	ecua.net.ec
Country	🇪🇨 Ecuador
City	Guayaquil, Guayas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.100.199.3

Whois 157.100.199.3

IP Abuse Reports for 157.100.199.3:

This IP address has been reported a total of 39 times from 24 distinct sources. 157.100.199.3 was first reported on March 25th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-14 23:11:51 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 157.100.199.3 (host-157-100-199-3.ecua.net.ec): ... show more (mod_security) mod_security (id:225170) triggered by 157.100.199.3 (host-157-100-199-3.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:11:44.982935 2026] [security2:error] [pid 17492:tid 17492] [client 157.100.199.3:36502] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|kporterdesign.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kporterdesign.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atAMMFcyNlS_Mli7zqR7YwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-10-14 12:06:07 (2 days ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-195)	Hacking
🇩🇪 Packets-Decreaser.NET	2026-10-10 19:36:26 (6 days ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 lostswordfish.com	2026-10-10 14:18:03 (6 days ago)	Wordfence waf block on secure2024 libjusco	Web App Attack
🇺🇸 TPI-Abuse	2026-09-29 17:26:58 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 157.100.199.3 (host-157-100-199-3.ecua.net.ec): ... show more (mod_security) mod_security (id:210350) triggered by 157.100.199.3 (host-157-100-199-3.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 13:26:51.296652 2026] [security2:error] [pid 27549:tid 27584] [client 157.100.199.3:14466] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|zammconstruction.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "zammconstruction.com"] [uri "/"] [unique_id "arv025uIsVrmvlqZrc_GLAAAAIM"], referer: https://bulkbacklinkanalyzer.space/dir/link-building-experts-241152 show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 Countryman	2026-09-28 00:10:01 (2 weeks ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇺🇸 鬼影233	2026-09-20 11:02:31 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-20 07:35:27 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-09-07 09:53:31 (1 month ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A337&f%5B1%5D=digest_key_terms%3A348&f%5B2%5D=digest_key_terms%3A517&f%5B3%5D=digest_key_terms%3A531&f%5B4%5D=digest_publication_type%3A927&field_article_edition%5B504%5D=504&field_key_terms%5B329%5D=329 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇩🇪 LRob	2026-08-20 00:04:52 (1 month ago)	L7 DDoS: distributed flood on a shop's faceted search — automated requests to search/sort URLs, one ... show more L7 DDoS: distributed flood on a shop's faceted search — automated requests to search/sort URLs, one or two per address from thousands of addresses, no page assets loaded \| path: /33-meilleur-velo-entre-5000-et-10000-euros \| query: order=product.name.asc&q=Famille-Ransom%2FSelections-Promo&resultsPerPage=12 show less	DDoS Attack Web App Attack
🇺🇸 kosada.com	2026-08-15 13:44:17 (2 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇩🇪 Admins@FBN	2026-07-17 11:56:38 (2 months ago)	FW-PortScan: Traffic Blocked srcport=30142 dstport=59710	Port Scan
🇷🇸 Scan	2026-07-16 14:48:48 (3 months ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
Anonymous	2026-07-08 16:52:10 (3 months ago)	unsolicited UDP packet to port 2561 (1315 bytes)	Hacking
🇯🇵 jay hung	2026-07-08 12:51:22 (3 months ago)	2026-07-08T12:51:22.305682+00:00 quarktech kernel: [2159740.780590] [UFW BLOCK] IN=eth0 OUT= MAC=22: ... show more 2026-07-08T12:51:22.305682+00:00 quarktech kernel: [2159740.780590] [UFW BLOCK] IN=eth0 OUT= MAC=22:00:92:2e:84:93:fe:ff:ff:ff:ff:ff:08:00 SRC=157.100.199.3 DST=172.237.20.248 LEN=61 TOS=0x00 PREC=0x40 TTL=44 ID=25614 DF PROTO=UDP SPT=30121 DPT=38623 LEN=41 ... show less	Port Scan

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 84.233.195.153

🇺🇸 34.181.179.9

🇳🇱 185.242.226.126

🇬🇧 165.22.121.203

🇬🇧 159.65.82.177

🇫🇮 147.185.133.24

🇬🇧 138.68.158.164

🇨🇳 121.224.5.228

🇮🇩 103.130.198.35

🇳🇱 95.97.140.118

🇩🇪 84.233.195.158

🇱🇹 62.60.130.253

🇩🇪 34.179.199.54

🇰🇷 218.149.228.141

🇬🇧 206.189.127.190

🇺🇸 157.230.218.106

🇸🇬 150.109.16.200

🇨🇳 119.249.100.47

🇻🇳 103.153.68.24

🇯🇵 8.216.5.129