AbuseIPDB » 157.22.103.202
157.22.103.202
This IP was reported 7 times. Confidence of
Abuse
is 15% : ?
ISP
Atlas Network Holdings LLC
Usage Type
Data Center/Web Hosting/Transit
ASN
AS213954
Domain Name
atlasnetworkholdings.online
Country
🇬🇧
United Kingdom of Great Britain and Northern Ireland
City
London, England
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 157.22.103.202 :
This IP address has been reported a total of
7
times from
3 distinct
sources.
157.22.103.202 was first reported on
April 13th 2026 , and the most recent report was
4 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-06-17 10:36:12
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 06:36:04.373643 2026] [security2:error] [pid 29518:tid 29518] [client 157.22.103.202:14739] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||advantage-plus.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "advantage-plus.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajJ4lC6oF57qjMZmoq9ofwAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-06-14 22:44:34
(2 days ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-06-09 14:19:00
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 10:18:53.170001 2026] [security2:error] [pid 25633:tid 25633] [client 157.22.103.202:20485] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ezekielproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ezekielproductions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiggzZiz_7Fj3CBHLs12zgAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 02:46:09
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 22:46:03.371279 2026] [security2:error] [pid 3856:tid 3980] [client 157.22.103.202:59289] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bortec-corp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bortec-corp.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahO364Hqat-GxGb3rahdOgAAAUg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-05 03:11:31
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.103.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 23:11:27.018973 2026] [security2:error] [pid 24463:tid 24463] [client 157.22.103.202:37999] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||healthydatasystems.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "healthydatasystems.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aflf37OPTphv8pTzPdriXAAAAAg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-04-13 15:43:03
(2 months ago)
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: elhacker.net userAgent: Apache-HttpC ...
show more
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: elhacker.net userAgent: Apache-HttpClient/4.5.13 (Java/11.0.30) Action: managed_challenge Source: firewallManaged ASN Description: GTS-AS Country: FI Method: POST Timestamp: 2026-04-13T15:43:03Z ruleId: 5de7edfa648c4d6891dc3e7f84534ffa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇪🇸
el-brujo
2026-04-13 15:43:01
(2 months ago)
[Mon Apr 13 17:43:01.227790 2026] [proxy_fcgi:error] [pid 3123689:tid 3124039] [remote 157.22.103.20 ...
show more
[Mon Apr 13 17:43:01.227790 2026] [proxy_fcgi:error] [pid 3123689:tid 3124039] [remote 157.22.103.202:0] AH01071: Got error 'Primary script unknown\n', referer: https://www.google.com
[Mon Apr 13 17:43:01.706020 2026] [proxy_fcgi:error] [pid 3123693:tid 3124394] [remote 157.22.103.202:0] AH01071: Got error 'Primary script unknown\n', referer: https://www.google.com
...
show less
Hacking
Web App Attack
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: