2026-05-22 13:35:17
(3 weeks ago)
LH-Watcher: FAKE_ID [Fake Googlebot]
Bad Web Bot
🇮🇩
securejdprop
2026-05-04 09:44:26
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent. Ip 198.37.109.46 perf ...
show more
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent. Ip 198.37.109.46 performed 'crowdsecurity/http-bad-user-agent' (2 events over 2.098892635s) at 2026-05-04 09:44:23.192087806 +0000 UTC
show less
Hacking
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-01 14:58:20
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 09:58:12.263865 2026] [security2:error] [pid 16723:tid 16820] [client 198.37.109.46:56951] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.staging.kettlehill.com"] [uri "/.env.kettlehill"] [unique_id "aX9qBP0s_0SzhyBvLdjC0QAAAw8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 17:16:42
(5 months ago)
(mod_security) mod_security (id:211070) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211070) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:11:36.336835 2025] [security2:error] [pid 23516:tid 23604] [client 198.37.109.46:40265] ModSecurity: Access denied with code 403 (phase 1). Pattern match "," at REQUEST_HEADERS:Transfer-Encoding. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "38"] [id "211070"] [rev "1"] [msg "COMODO WAF: HTTP Request Smuggling Attack.||kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.com"] [uri "/tmui/login.jsp"] [unique_id "aVK2SAtJvz4KODtZUgY8KwAAAE8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-12 09:32:25
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 04:32:20.289300 2025] [security2:error] [pid 30701:tid 30701] [client 198.37.109.46:53221] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||nbcnewsradio.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nbcnewsradio.com"] [uri "/...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\windows\\\\win.ini"] [unique_id "aRRUJOThA_bGbYhmzAtTHgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 14:49:29
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 10:49:23.031414 2025] [security2:error] [pid 17241:tid 17262] [client 198.37.109.46:46739] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.com"] [uri "/1.sql"] [unique_id "aN0_c6h4GLz6vZLSqBys7gAAAI8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 01:11:31
(10 months ago)
(mod_security) mod_security (id:211190) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 21:11:23.693485 2025] [security2:error] [pid 404369:tid 404483] [client 198.37.109.46:56721] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.com"] [uri "/cgi-bin/wapopen"] [unique_id "aIV8u41ApCwrT9-Kn8W8gAAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2025-05-29 18:21:18
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 198.37.109.46
2025-05-29T19:02:00+02: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 198.37.109.46
2025-05-29T19:02:00+02:00 vpn Access-Reject 'tajcova' station: 198.37.109.46 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2025-05-29 09:21:49
(1 year ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 198.37.109.46
2025-05-29T10:48:59+02: ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 198.37.109.46
2025-05-29T10:48:59+02:00 vpn Access-Reject 'xspej10' station: 198.37.109.46 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2025-05-29T11:05:14+02:00 vpn Access-Reject 'xsilz02' station: 198.37.109.46 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2025-05-29 03:21:39
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 198.37.109.46
2025-05-29T04:34:34+02: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 198.37.109.46
2025-05-29T04:34:34+02:00 vpn Access-Reject 'xpeta16' station: 198.37.109.46 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-05-28 21:27:48
(1 year ago)
GlobalProtect login attempts with user wil.
VPN IP
Brute-Force
🇺🇸
TPI-Abuse
2025-04-19 03:07:56
(1 year ago)
(mod_security) mod_security (id:211190) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 198.37.109.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 18 23:06:58.316496 2025] [security2:error] [pid 14944:tid 14954] [client 198.37.109.46:33325] [client 198.37.109.46] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||blog.spinningdesigns.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blog.spinningdesigns.com"] [uri "/index.php"] [unique_id "aAMTUqlkjOMtrQ4IEmngrgAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-01-15 08:31:39
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇫🇮
nyuuzyou
2024-10-08 00:08:39
(1 year ago)
Intensive scraping: /web?s=plastic%20pvc%20water%20pipe&scraper=mwmbl. User-Agent: Mozilla/5.0 (X11; ...
show more
Intensive scraping: /web?s=plastic%20pvc%20water%20pipe&scraper=mwmbl. User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68.
show less
Bad Web Bot