JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

157.22.73.252

Recent Activity

Abuse Confidence Score

38% Elevated

21 reports

13 reporters · latest 1 hour ago

ISP: Global Transit Systems LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS213954
Domain Name: globaltransitsystems.online
Country: 🇺🇸 United States of America
City: New York City, New York

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

21 from 13 distinct reporters

First reported

March 4th 2026

Most recent report

1 hour ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 5 🇧🇪 Belgium 2 🇨🇿 Czechia 2

Most common categories Web App Attack 9 Brute-Force 7 Bad Web Bot 6 Hacking 3 SQL Injection 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-11-15 12:46:57 UTC · (1 hour ago)	(mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 07:46:50.285680 2026] [security2:error] [pid 28131:tid 28131] [client 157.22.73.252:40205] M ... show more (mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 07:46:50.285680 2026] [security2:error] [pid 28131:tid 28131] [client 157.22.73.252:40205] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|lightningbug.farm\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lightningbug.farm"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "avmputv9PJzFbofdu3FwkQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-14 23:18:58 UTC · (15 hours ago)	(mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:18:53.851695 2026] [security2:error] [pid 13210:tid 13210] [client 157.22.73.252:35355] M ... show more (mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:18:53.851695 2026] [security2:error] [pid 13210:tid 13210] [client 157.22.73.252:35355] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|pjv.us\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "pjv.us"] [uri "/fluxbb-karen/viewtopic.php"] [unique_id "avjsXfX7N0b-mkzGcY-fvwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-12 00:47:49 UTC · (3 days ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-11-08 10:47:19 UTC · (1 week ago)	(mod_security) mod_security (id:210730) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:47:12.451710 2026] [security2:error] [pid 30558:tid 30558] [client 157.22.73.252:38375] M ... show more (mod_security) mod_security (id:210730) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:47:12.451710 2026] [security2:error] [pid 30558:tid 30558] [client 157.22.73.252:38375] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.tribwatch.com\|F\|2"] [data ".free-coat- of-arms.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.tribwatch.com"] [uri "/up/www.free-coat- of-arms.com"] [unique_id "avBTME7nvxbAzTfKjln62wAAAAI"], referer: https://www.tribwatch.com/up/updateIraq6Dec4.htm show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 librebit	2026-11-06 08:37:57 UTC · (1 week ago)	Brute force	Brute-Force
Anonymous	2026-11-03 15:10:07 UTC · (1 week ago)	\| High amount of POST requests in a small period of time (likely bot).	Web App Attack Hacking SQL Injection
🇳🇱 homeshowdomain.nl	2026-11-02 23:01:59 UTC · (1 week ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-01.	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-11-02 21:57:19 UTC · (1 week ago)	(mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 16:57:12.593430 2026] [security2:error] [pid 5115:tid 5115] [client 157.22.73.252:37835] Mod ... show more (mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 16:57:12.593430 2026] [security2:error] [pid 5115:tid 5115] [client 157.22.73.252:37835] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.flavornet.org\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/111-70-6.html"] [unique_id "aukHOM_LbEqFzbCr1w0USAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-10-26 05:36:47 UTC · (2 weeks ago)	Many_bad_calls	Web App Attack
🇺🇸 TPI-Abuse	2026-10-25 16:14:08 UTC · (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:14:03.587800 2026] [security2:error] [pid 11333:tid 11333] [client 157.22.73.252:43231] M ... show more (mod_security) mod_security (id:210350) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:14:03.587800 2026] [security2:error] [pid 11333:tid 11333] [client 157.22.73.252:43231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|rememberingjohnhanson.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rememberingjohnhanson.com"] [uri "/Remembering_John_Hanson/Synopsis.html"] [unique_id "at4qy1U8DfQqaOV3NcizlQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-10-25 07:06:24 UTC · (3 weeks ago)	Bad_requests	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-16 03:40:55 UTC · (1 month ago)	(mod_security) mod_security (id:225170) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 23:40:49.298712 2026] [security2:error] [pid 27570:tid 27570] [client 157.22.73.252:9671] Mo ... show more (mod_security) mod_security (id:225170) triggered by 157.22.73.252 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 23:40:49.298712 2026] [security2:error] [pid 27570:tid 27570] [client 157.22.73.252:9671] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|puoci.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "puoci.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqoPwTXRrblNk5RcpRE4cwAAAAI"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nationaleventpros.com	2026-09-15 13:49:03 UTC · (2 months ago)	WordPress login attempt	Brute-Force
Anonymous	2026-05-30 11:42:02 UTC · (5 months ago)	157.22.73.252 - - [30/May/2026:13:41:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 346 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.73.252 - - [30/May/2026:13:41:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 132 "-" "Apache-HttpClient/4.5.13 (Java/11 ... show more 157.22.73.252 - - [30/May/2026:13:41:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 346 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.73.252 - - [30/May/2026:13:41:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 132 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.73.252 - - [30/May/2026:13:41:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 420 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.73.252 - - [30/May/2026:13:41:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" 157.22.73.252 - - [30/May/2026:13:42:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 132 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" ... show less	Brute-Force Web App Attack
🇨🇿 ptlab	2026-04-20 22:48:03 UTC · (6 months ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇿🇦 197.185.142.154

🇺🇸 167.172.143.152

🇩🇪 167.94.146.64

🇵🇰 119.157.76.121

🇨🇳 223.104.205.231

🇺🇸 206.189.235.100

🇺🇸 193.37.252.71

🇺🇦 188.114.194.49

🇺🇦 185.70.18.35

🇨🇳 171.36.210.1

🇺🇸 159.65.239.48

🇺🇸 136.67.154.210

🇵🇱 91.236.172.11

🇧🇬 79.110.113.171

🇨🇳 59.52.179.140

🇨🇳 58.243.126.104

🇺🇸 51.81.103.250

🇳🇱 35.214.243.124

🇬🇧 35.203.210.60

🇳🇱 34.3.82.51