JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

157.22.46.149

Activity Trending Down

Abuse Confidence Score

16% Caution

13 reports

11 reporters · latest 2 weeks ago

ISP: Atlas Network Holdings LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS213954
Domain Name: atlasnetworkholdings.online
Country: 🇺🇸 United States of America
City: New York City, New York

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

13 from 11 distinct reporters

First reported

February 14th 2026

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇨🇿 Czechia 1 🇮🇩 Indonesia 1 🇺🇸 United States of America 1

Most common categories Brute-Force 3 Web App Attack 2 Bad Web Bot 1 VPN IP 1 Hacking 1

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-24 06:49:55 UTC · (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 157.22.46.149 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 02:49:51.502128 2026] [security2:error] [pid 26132:tid 26132] [client 157.22.46.149:27175] M ... show more (mod_security) mod_security (id:210350) triggered by 157.22.46.149 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 02:49:51.502128 2026] [security2:error] [pid 26132:tid 26132] [client 157.22.46.149:27175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|1214productions.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "1214productions.com"] [uri "/logos.html"] [unique_id "atxVD72p8PNHJiHlTksXtwAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 arreezy	2026-09-14 19:38:41 UTC · (1 month ago)	Repeated ActiveSync or Autodiscover authentication probing resulting in HTTP 401/403 responses.	Brute-Force Web App Attack
🇨🇿 Countryman	2026-09-13 00:10:01 UTC · (1 month ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇺🇸 agabeckov	2026-09-10 22:20:32 UTC · (1 month ago)	Fail2Ban detected brute-force attempt on Cisco Anyconnect	VPN IP Brute-Force
🇺🇦 URAN Publishing Service	2026-09-02 04:13:01 UTC · (2 months ago)	[02/Sep/2026:07:13:01 +0300] -- 157.22.46.149 Ban reason: User-Agent curl/	Bad Web Bot Web App Attack
🇨🇭 backslash	2026-09-01 03:03:02 UTC · (2 months ago)	block ruleset 51D5331ECDCF70C2C6410C0D0EEB5F69B17B5F56	Bad Web Bot
🇩🇪 C C	2026-08-12 00:07:02 UTC · (2 months ago)	Distributed scraping attack: 1244 req from 1212 rotating proxy IPs \| this IP: 1 req	Open Proxy Bad Web Bot Exploited Host Web App Attack
🇺🇸 nationaleventpros.com	2026-06-14 23:17:38 UTC · (4 months ago)	WordPress login attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-05-09 21:16:30 UTC · (6 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.46.149 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 17:16:22.611412 2026] [security2:error] [pid 7857:tid 7857] [client 157.22.46.149:17549] Mod ... show more (mod_security) mod_security (id:225170) triggered by 157.22.46.149 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 17:16:22.611412 2026] [security2:error] [pid 7857:tid 7857] [client 157.22.46.149:17549] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gonzalez.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gonzalez.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af-kJsHYvcrEzhMX_os5DAAAAAQ"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 solution.it	2026-05-02 02:16:24 UTC · (6 months ago)	[Sat May 02 04:16:23.724867 2026] [php7:error] [pid 166097:tid 166097] [client 157.22.46.149:51585] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat	Web App Attack
🇺🇸 octageeks.com	2026-04-27 04:11:18 UTC · (6 months ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇺🇸 ambor	2026-03-30 05:33:18 UTC · (7 months ago)	Honeypot access: WordPress admin access attempt. Path: /wp-login.php	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-02-14 12:44:13 UTC · (8 months ago)	(mod_security) mod_security (id:240335) triggered by 157.22.46.149 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 07:44:07.829961 2026] [security2:error] [pid 4191916:tid 4191916] [client 157.22.46.149:6433 ... show more (mod_security) mod_security (id:240335) triggered by 157.22.46.149 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 07:44:07.829961 2026] [security2:error] [pid 4191916:tid 4191916] [client 157.22.46.149:64331] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.22.46.149 (+1 hits since last alert)\|gonzalez.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gonzalez.com"] [uri "/wp-admin/xmlrpc.php"] [unique_id "aZBuF5R8SHwrbs_j7Yn5fQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 2400:cb00:929:1000:de1c:545a:61be:e49e

🇮🇩 2400:b8a0:248:0:be24:11ff:fe4a:ca7a

🇭🇰 223.197.146.179

🇨🇴 190.60.60.245

🇨🇭 179.43.153.10

🇸🇬 175.156.127.110

🇨🇳 120.48.11.149

🇺🇸 24.33.143.168

🇩🇪 2400:cb00:929:1000:85b8:f5f0:e677:ee87

🇰🇷 221.168.252.11

🇻🇳 125.212.218.63

🇲🇾 120.141.29.9

🇳🇱 109.160.32.144

🇨🇦 85.217.149.73

🇺🇸 73.18.246.61

🇧🇪 35.210.18.21

🇳🇱 204.76.203.44

🇦🇷 168.228.58.93

🇵🇭 123.253.50.108

🇺🇸 91.230.168.19