JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 198.105.111.13

198.105.111.13 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 0%: ?

ISP	SYN LTD
Usage Type	Fixed Line ISP
ASN	AS64080
Domain Name	syn.uk
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 198.105.111.13

Whois 198.105.111.13

IP Abuse Reports for 198.105.111.13:

This IP address has been reported a total of 15 times from 7 distinct sources. 198.105.111.13 was first reported on October 30th 2023, and the most recent report was 5 months ago.

Old Reports: The most recent abuse report for this IP address is from 5 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-01-17 05:00:43 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 00:00:35.755844 2026] [security2:error] [pid 24256:tid 24256] [client 198.105.111.13:42015] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.old"] [unique_id "aWsXc0OLvRSh6orHtOSzOgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 18:40:44 (5 months ago)	(mod_security) mod_security (id:211190) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211190) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 13:40:37.252094 2025] [security2:error] [pid 22838:tid 22922] [client 198.105.111.13:53827] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|ftp.kettlehill.net\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_rsfiles&task=files.display&path=../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.net"] [uri "/index.php"] [unique_id "aVLLJeHXaA_hkms52yNtgwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-13 10:41:59 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 05:41:52.630950 2025] [security2:error] [pid 29771:tid 29771] [client 198.105.111.13:41267] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/.env.dev"] [unique_id "aRW18Lmi3G59n9TB7L6krwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 RoboSOC	2025-10-16 08:34:17 (8 months ago)	Bash Remote Code Execution Vulnerability , PTR: PTR record not found	Hacking
🇺🇸 TPI-Abuse	2025-07-27 00:24:26 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:24:00.384880 2025] [security2:error] [pid 172224:tid 172363] [client 198.105.111.13:34927] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.kettlehill.com"] [uri "/.svn/entries"] [unique_id "aIVxoPsl9f9qGESiG9bTBQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-05-29 16:25:56 (1 year ago)	(mod_security) mod_security (id:212750) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:212750) triggered by 198.105.111.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 12:25:49.841899 2025] [security2:error] [pid 2968237:tid 2968237] [client 198.105.111.13:34937] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|www.farmers123.com\|F\|2"] [data "Matched Data: onerror= found within REQUEST_URI: /?p=1&xsg-provider=<img src onerror=alert(document.domain)>&xsg-format=yyy&xsg-type=zz&xsg-page=pp"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.farmers123.com"] [uri "/"] [unique_id "aDiKjRjuWYAt9CiK8qEWmwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-01-17 14:10:05 (1 year ago)	\| Shellshock attack detected	Hacking SQL Injection Web App Attack
🇺🇸 nowyouknow	2024-08-31 20:05:13 (1 year ago)	(From [email protected]) Hi, it's Jason reaching out. I just visited your website and notice ... show more (From [email protected]) Hi, it's Jason reaching out. I just visited your website and noticed a couple of areas where minor tweaks could increase your more leads. I've helped several clients in your industry upgrade their websites, and they noticed considerable growth in leads as a result. I'd be happy to hop on a quick call to discuss these improvements with you. I'm available this week, so at no cost, just to help. Tell me the best way to get in touch, and we can find a suitable time. These are straightforward changes and won't require much time. Kind Regards, Jason Clemens -- Visit: https://bit.ly/FreeWebsiteAuditByJason Or reply to this email [email protected] or call me at: +1-651-419-8101 show less	Phishing Web Spam
🇸🇬 oncord	2024-08-29 08:44:12 (1 year ago)	Form spam	Web Spam
🇺🇸 nowyouknow	2024-08-27 02:16:19 (1 year ago)	(From [email protected]) We connect with your clients: Managed Cold Email Outreach Campaign p ... show more (From [email protected]) We connect with your clients: Managed Cold Email Outreach Campaign provides everything required to boost your outreach and achieve success—all for under £200 monthly! What You Get: + 5 Custom Email Domains ($75 Worth) + Professionally Managed + Setup & Pre-launch Warm-Up & Launch + 25 Google Workspace Accounts ($150 Value per Month) + 5 Simultaneous Campaigns + Up to 1250 Emails Sent Daily + Split Testing and Enhancements + Top-Performing Email Content + Free Email Database ($500 Worth) + Industry, City, State Targeting + Campaign Software Comparable to Lemlist ($249 Monthly Value) + Support by Personal Account Manager For only £199 each month, you can access the full suite to power your email marketing campaigns and see real results. * Get started now: https://bit.ly/inboximpacts To unsubscribe, reply to this email with 'Unsubscribe' as the subject. 14 High Street, Ashby By Partney, NY, United States show less	Phishing Web Spam
Anonymous	2024-08-24 01:38:30 (1 year ago)		Web Spam
🇸🇬 oncord	2024-08-23 16:13:02 (1 year ago)	Form spam	Web Spam
Anonymous	2024-08-10 21:59:04 (1 year ago)		Web Spam
🇺🇸 ChamberofCommerce.com	2023-11-06 04:29:08 (2 years ago)	Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested ... show more Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:226 show less	Bad Web Bot
🇺🇸 ChamberofCommerce.com	2023-10-30 20:40:26 (2 years ago)	Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested ... show more Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:227 show less	Bad Web Bot

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 65.181.112.131

🇧🇷 20.197.192.74

🇫🇷 194.163.172.220

🇲🇽 189.204.230.91

🇺🇾 186.52.191.125

🇰🇷 112.185.233.100

🇫🇷 85.217.140.28

🇺🇸 76.157.106.210

🇱🇹 62.60.130.219

🇬🇧 34.39.83.247

🇵🇰 202.165.250.11

🇧🇷 181.218.9.86

🇳🇱 142.93.131.123

🇲🇦 102.51.27.1

🇨🇦 85.217.149.28

🇳🇱 45.153.34.87

🇧🇷 34.39.202.182

🇺🇸 174.138.69.245

🇳🇱 173.194.170.29

🇺🇸 161.35.132.15