AbuseIPDB » 157.22.19.140
157.22.19.140
This IP was reported 6 times. Confidence of
Abuse
is 5% : ?
ISP
Global Transit Systems LLC
Usage Type
Data Center/Web Hosting/Transit
ASN
AS213954
Domain Name
globaltransitsystems.online
Country
🇸🇪
Sweden
City
Gusum, Ostergotland
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 157.22.19.140 :
This IP address has been reported a total of
6
times from
5 distinct
sources.
157.22.19.140 was first reported on
December 19th 2025 , and the most recent report was
5 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-07-21 08:53:59
(5 hours ago)
(mod_security) mod_security (id:218580) triggered by 157.22.19.140 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:218580) triggered by 157.22.19.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 04:53:53.482907 2026] [security2:error] [pid 104190:tid 104190] [client 157.22.19.140:62045] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\*[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:imgcode. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.||powerkiteforum.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "powerkiteforum.com"] [uri "/search.php"] [unique_id "al8zoQOt9hGMw4cVlhcMhQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 11:37:49
(2 days ago)
(mod_security) mod_security (id:218580) triggered by 157.22.19.140 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:218580) triggered by 157.22.19.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 07:37:46.009188 2026] [security2:error] [pid 23205:tid 23205] [client 157.22.19.140:22089] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\*[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:codigo. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.||www.clubfansite.com.creartest.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.clubfansite.com.creartest.com"] [uri "/apuntarse.php"] [unique_id "aly3CvFu0zqVDhhwoKX_TAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-05-17 11:20:52
(2 months ago)
Fail2Ban banned 157.22.19.140 for security violations in jail wp-armour. Log: 2026/05/17 11:20:52 [e ...
show more
Fail2Ban banned 157.22.19.140 for security violations in jail wp-armour. Log: 2026/05/17 11:20:52 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.19.140 | Target: wplogin" , client: 157.22.19.140, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
2026-05-01 05:00:19
(2 months ago)
[redacted] 157.22.19.140 - - [01/May/2026:07:00:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "A ...
show more
[redacted] 157.22.19.140 - - [01/May/2026:07:00:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 157.22.19.140 - - [01/May/2026:07:00:14 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 157.22.19.140 - - [01/May/2026:07:00:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 157.22.19.140 - - [01/May/2026:07:00:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 157.22.19.140 - - [01/May/2026:07:00:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
...
show less
Hacking
Web App Attack
🇺🇸
mind5t0rm
2026-02-07 17:21:51
(5 months ago)
(WPLOGIN) WP Login Attack 157.22.19.140 (SE/Sweden/-): 3 in the last 3600 secs; Ports: *; Direction: ...
show more
(WPLOGIN) WP Login Attack 157.22.19.140 (SE/Sweden/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 157.22.19.140 - - [08/Feb/2026:00:21:39 +0700] "GET /wp-login.php?wp_lang=en_US HTTP/2.0" 200 2453 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36"
157.22.19.140 - - [08/Feb/2026:00:21:40 +0700] "POST /wp-login.php?wp_lang=en_US HTTP/2.0" 302 0 "https://zerowaterthailand.com/wp-login.php?wp_lang=en_US" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36"
157.22.19.140 - - [08/Feb/2026:00:21:46 +0700] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.zerowaterthailand.com%2Fwp-admin%2Fplugins.php&reauth=1 HTTP/2.0" 200 2460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36"
show less
Port Scan
🇫🇷
masterguru
2025-12-19 01:07:53
(7 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 157.22.19.140 (SE/Sweden/-): 1 in the last 360 ...
show more
(modsec_5015) ModSec 5015: Suspicious User-Agent from 157.22.19.140 (SE/Sweden/-): 1 in the last 3600 secs (0-196)
show less
Hacking
Showing 1 to
6
of 6 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: