JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.22.47.96

157.22.47.96 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 25%: ?

25%

ISP	Global Transit Systems LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213954
Domain Name	globaltransitsystems.online
Country	🇸🇪 Sweden
City	Marsta, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.22.47.96

Whois 157.22.47.96

IP Abuse Reports for 157.22.47.96:

This IP address has been reported a total of 15 times from 10 distinct sources. 157.22.47.96 was first reported on March 7th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 zynex	2026-07-21 09:48:54 (3 days ago)	URL Probing: /wp-login.php	Web App Attack
Anonymous	2026-07-19 19:31:19 (5 days ago)	FPROCO WEBEXPLOIT 157.22.47.96 (157.22.47.96)	Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 16:09:05 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 12:08:58.612096 2026] [security2:error] [pid 10169:tid 10169] [client 157.22.47.96:14151] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|talkingmess.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "talkingmess.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alewms43pzP7TmviVHNV8AAAAAQ"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-06-02 23:30:13 (1 month ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-05-13 02:37:51 (2 months ago)	157.22.47.96 - - [13/May/2026:04:37:43 +0200] "POST /blog/wp-login.php HTTP/1.1" 200 3936 "https://s ... show more 157.22.47.96 - - [13/May/2026:04:37:43 +0200] "POST /blog/wp-login.php HTTP/1.1" 200 3936 "https://spacehost.de/blog/wp-login.php" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10" 157.22.47.96 - - [13/May/2026:04:37:46 +0200] "POST /blog/wp-login.php HTTP/1.1" 200 3941 "https://spacehost.de/blog/wp-login.php" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10" 157.22.47.96 - - [13/May/2026:04:37:50 +0200] "POST /blog/wp-login.php HTTP/1.1" 200 3942 "https://spacehost.de/blog/wp-login.php" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10" show less	Hacking Web App Attack
🇺🇸 octageeks.com	2026-05-07 04:07:43 (2 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇺🇸 myagent.site	2026-03-21 10:22:32 (4 months ago)	Blocking for trying to access an exploit file: /xmlrpc.php	Hacking
🇺🇸 myagent.site	2026-03-19 04:46:33 (4 months ago)	Blocking for trying to access an exploit file: /xmlrpc.php	Hacking
🇩🇪 LRob	2026-03-18 05:30:18 (4 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-17 22:12:28 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 18:12:22.263237 2026] [security2:error] [pid 30502:tid 30502] [client 157.22.47.96:53827] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|crowleywoodworking.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "crowleywoodworking.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abnRxrrNEG812wtSko15KAAAAA8"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mind5t0rm	2026-03-16 19:01:40 (4 months ago)	(XMLRPC,WPLOGIN) Login failure/trigger from 157.22.47.96 (SC/Seychelles/-): 3 in the last 3600 secs; ... show more (XMLRPC,WPLOGIN) Login failure/trigger from 157.22.47.96 (SC/Seychelles/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 157.22.47.96 - - [17/Mar/2026:01:52:07 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.47.96 - - [17/Mar/2026:01:52:09 +0700] "GET /wp-login.php HTTP/2.0" 200 2349 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 157.22.47.96 - - [17/Mar/2026:02:01:38 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" show less	Port Scan
🇺🇸 Jason Howell	2026-03-16 17:52:28 (4 months ago)	157.22.47.96 - - [16/Mar/2026:12:43:04 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2728 "-" "Apache-HttpC ... show more 157.22.47.96 - - [16/Mar/2026:12:43:04 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2728 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.47.96 - - [16/Mar/2026:12:43:05 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2803 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.47.96 - - [16/Mar/2026:12:43:06 -0500] "GET /wp-login.php HTTP/1.1" 200 3988 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 157.22.47.96 - - [16/Mar/2026:12:52:26 -0500] "GET /wp-login.php HTTP/1.1" 200 3987 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 157.22.47.96 - - [16/Mar/2026:12:52:27 -0500] "POST /wp-login.php HTTP/1.1" 200 4349 "https://qctotaltech.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 dynamix	2026-03-16 15:50:55 (4 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-03-12 12:55:16 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 12 08:55:08.626747 2026] [security2:error] [pid 21351:tid 21351] [client 157.22.47.96:14229] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|laradioactivitat.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "laradioactivitat.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abK3rI_QkkPSOR3JoYNQlQAAACA"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-07 11:36:00 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 157.22.47.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 07 06:35:55.447464 2026] [security2:error] [pid 27095:tid 27095] [client 157.22.47.96:38375] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|techlinks.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "techlinks.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aawNm8xY98rUTXXO3-o3pgAAAAA"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a04:4e40:e000:0:26d:61a6:9895:f563

🇺🇸 205.210.31.72

🇺🇸 156.146.54.57

🇵🇱 79.133.202.126

🇫🇷 77.237.244.154

🇺🇸 45.33.65.239

🇨🇳 14.103.63.16

🇨🇳 223.199.188.111

🇬🇧 159.65.81.207

🇫🇷 109.205.182.48

🇩🇪 100.42.189.89

🇫🇷 86.48.3.3

🇩🇪 69.5.169.127

🇺🇸 23.239.12.207

🇺🇸 216.73.216.189

🇺🇸 192.241.248.28

🇦🇷 181.84.11.251

🇨🇳 140.250.88.164

🇰🇷 121.159.71.249

🇷🇺 109.173.39.103