JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.22.17.156

157.22.17.156 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 20%: ?

20%

ISP	Global Transit Systems LLC
Usage Type	Fixed Line ISP
ASN	AS213954
Domain Name	globaltransitsystems.online
Country	🇸🇪 Sweden
City	Marsta, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.22.17.156

Whois 157.22.17.156

IP Abuse Reports for 157.22.17.156:

This IP address has been reported a total of 13 times from 7 distinct sources. 157.22.17.156 was first reported on January 3rd 2026, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 Saec	2026-07-02 08:15:09 (5 days ago)	Jarvis auto-ban: CF honeypot path /wp-admin/xmlrpc.php (3× on saec.me)	Port Scan Web App Attack
🇨🇭 backslash	2026-07-01 18:57:00 (5 days ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇫🇷 Tilellit.PRO	2026-05-21 12:11:47 (1 month ago)	Fail2Ban banned 157.22.17.156 for security violations in jail wp-armour. Log: 2026/05/21 12:11:47 [e ... show more Fail2Ban banned 157.22.17.156 for security violations in jail wp-armour. Log: 2026/05/21 12:11:47 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.17.156 \| Target: wplogin" , client: 157.22.17.156, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
Anonymous	2026-05-08 16:18:18 (1 month ago)	[redacted] 157.22.17.156 - - [08/May/2026:18:18:13 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "A ... show more [redacted] 157.22.17.156 - - [08/May/2026:18:18:13 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 157.22.17.156 - - [08/May/2026:18:18:14 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 157.22.17.156 - - [08/May/2026:18:18:15 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 157.22.17.156 - - [08/May/2026:18:18:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 157.22.17.156 - - [08/May/2026:18:18:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" ... show less	Hacking Web App Attack
🇫🇷 Tilellit.PRO	2026-05-06 21:57:22 (2 months ago)	Fail2Ban banned 157.22.17.156 for security violations in jail wp-armour. Log: 2026/05/06 21:57:22 [e ... show more Fail2Ban banned 157.22.17.156 for security violations in jail wp-armour. Log: 2026/05/06 21:57:22 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.17.156 \| Target: wplogin" , client: 157.22.17.156, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
🇮🇩 Burayot	2026-05-01 01:42:55 (2 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 157.22.17.156 (NL/Netherlands/-): 1 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 157.22.17.156 (NL/Netherlands/-): 1 in the last 3600 secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-03-29 00:43:42 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 28 20:43:36.595029 2026] [security2:error] [pid 12078:tid 12078] [client 157.22.17.156:24497] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|braddonengineering.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "braddonengineering.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ach1uKAyzqBc7obglNFFRQAAAA8"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-03-25 10:25:59 (3 months ago)	FPROCO WEBEXPLOIT 157.22.17.156 (157.22.17.156)	Web App Attack
🇺🇸 TPI-Abuse	2026-03-21 23:51:25 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 19:51:21.061873 2026] [security2:error] [pid 10124:tid 10124] [client 157.22.17.156:44461] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|prodigypartners.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "prodigypartners.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab8u-VMfRb5WZ88r42MHsgAAAA0"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-20 09:25:39 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:25:33.608199 2026] [security2:error] [pid 4119:tid 4119] [client 157.22.17.156:40277] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|ohnosound.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ohnosound.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab0SjQmgh4w0DKK27Veq9gAAAAc"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-17 03:20:48 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 16 23:20:44.192148 2026] [security2:error] [pid 26085:tid 26085] [client 157.22.17.156:34303] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gonzalez.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gonzalez.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abjIjLcThhC8yiOo6yg39QAAAA4"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-14 15:00:06 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 157.22.17.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 11:00:00.066305 2026] [security2:error] [pid 27797:tid 27797] [client 157.22.17.156:11897] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|otrantocapital.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "otrantocapital.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abV38Fghbr4nUrAGBW84uwAAADE"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2026-01-03 20:05:07 (6 months ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 51.159.149.103

🇻🇳 14.248.83.33

🇨🇦 178.93.200.208

🇺🇸 162.216.149.112

🇩🇪 151.243.11.245

🇺🇸 104.236.53.110

🇮🇩 103.112.5.7

🇺🇸 65.49.1.168

🇫🇷 51.68.233.22

🇺🇸 24.199.88.142

🇺🇸 8.228.27.10

🇰🇷 211.223.41.90

🇦🇺 203.185.198.246

🇧🇴 190.181.44.194

🇩🇪 185.254.75.27

🇺🇸 158.94.187.207

🇨🇳 116.179.37.123

🇨🇳 116.179.37.35

🇳🇬 102.89.33.116

🇵🇹 81.193.216.17