:( IP Blocked - resolved

[Juice]

If anyone noticed my sudden disappearance about a month ago, it's because the site won't load on either of my computers, nor my Blackberry (on WiFi) or my iPod Touch. I just now found that it will load if I'm using my Blackberry on the mobile network.

Any computer savvy fold have an idea why this is happening? Did you guys do a blanket ban on a host or anything?

It might also be my router, but this is the only site affected.

Any ideas? Thanks

[RacerX]

Oh crap! He's back! Everybody Ping his IP addy with 8mb packets to bog his link! :D

If it's JUST this site, you may want to clear cookies, internet cache, etc. Are you using IE, Mozilla...???

[MM03MOK]

Haven't done anything different here. Check you privacy settings to make sure the website isn't blocked. Very odd that it happens on all your devices save one. Can you see the website without logging in and only have trouble trying to log in? Have you tried someone else's computer?

PM me or post your IP address. The server could have mistaken your continued attempts to log in as an attack and blocked your IP.

[Motorhead350]

Banned...............?

[Juice]

It only works on my Blackberry if I'm using the mobile network, it won't load if I'm using my phone on my WiFi. That means all 4 of my devices don't work on my network. I guess I could try wiping my router, I'll have to mess around with it more when I get some free time. I'll get my IP to you later today. Thanks,

[MM03MOK]

It only works on my Blackberry if I'm using the mobile network, it won't load if I'm using my phone on my WiFi. That means all 4 of my devices don't work on my network. I guess I could try wiping my router, I'll have to mess around with it more when I get some free time. I'll get my IP to you later today. Thanks,
Don't do anything until you give me your IP address. It could be as simple as that if it is blocked by the server and save you the effort of troubleshooting.

[FormulaMarauder]

I had the same problem for a while, and is often re-occurring. After a while it just fixes itself. Strange.

[dakslim]

I had the same problem for a while, and is often re-occurring. After a while it just fixes itself. Strange.

Maybe it's called the "Zack attack".:P

[RacerX]

Don't do anything until you give me your IP address. It could be as simple as that if it is blocked by the server and save you the effort of troubleshooting.
+1 Won't be in the router. Not with one web site and multiple devices.

[Rockettman]

Maybe it's called the "Zack attack".:P

Please just don't start this !! :shake:

[J-MAN]

Nothing personal. Your name just came up.

[silver_2000]

ip was blocked in September


Time: Tue Sep 14 08:31:08 2010 -0500
IP: 74.76.123.68 (US/United States/cpe-74-76-123-68.nycap.res.rr.com)

apparently from trying to post this over and over

"/forums/<a href=http://img412.imageshack.us/i/clean1.jpg/ target=_blank>[IMG]http://img412.imageshack.us/img412/7214/clean1.th.jpg"]"

[MM03MOK]

If you are having issues logging in, don't keep trying. The server is trying to protect itself and blocks the "attacking" IP address. Please post up from another computer or reach out to me if you're having issues. Click "Contact Us" and send me an email.

Thanks, Doug!

[silver_2000]

If you are having issues logging in, don't keep trying. The server is trying to protect itself and blocks the "attacking" IP address. Please post up from another computer or reach out to me if you're having issues. Click "Contact Us" and send me an email.

Thanks, Doug!
FYI ....
by the time you get blocked you wont be able to hit the contact us site ...

Essentially you will need to send an email to Mary from Gmail or Yahoo.

[Juice]

ip was blocked in September

Hmm, that's weird. I've never seen that image, nor have I ever tried to post it.

Everything seems to be in order now, I'm posting this from my desktop. Thanks for the speedy fix! :beer:

[MM03MOK]

Hmm, that's weird. I've never seen that image, nor have I ever tried to post it.

HUH? What are you talking about? What image?

[RacerX]

The image silver 2000 reported as a multiple attempted post: http://img412.imageshack.us/i/clean1.jpg

It's a white wannabe/Marauder for those worried about the pic.

[MM03MOK]

The image silver 2000 reported as a multiple attempted post: http://img412.imageshack.us/i/clean1.jpg

It's a white wannabe/Marauder for those worried about the pic.
Gotcha! Thanks. I only saw text and no hotlink, so my eyes scanned right by it.

[silver_2000]

FYI - if you get blocked by the firewall the firewall has blocked your external IP address - so ANY computer or device in your house using your network will also be blocked -

One way to test it and get back to the site to report it is to unplug your router or cable modem for 10 or 15 minutes - maybe overnight

What that should do is get you a FRESH IP address which will get you past the block - if you can then contact Mary with your old IP we can try to figure out if you were blocked by the firewall and perhaps why ...

The server runs a number of web sites and to keep everyone safe we have a firewall that is designed to keep the bad guys out - we block entire ranges of IPs by country and yet daily we get MANY attempts at the server that are seen as malicious. Most of the time the server initially blocks the IP address temporarily at first, for 10-15 minutes then automatically unblocks it. Its only after the server sees MANY repeated similar attempts that the IP address is blocked permanently...

The server runs 8 or 9 pretty popular Vbulletin forums and even with thousands of people using the server every hour - these issues crop up only 3 or 4 times a year. What that means is there are very few real users getting blocked and lots of bad guys getting blocked.

here is an example of an easy to understand block that happened yesterday


Time: Thu Oct 28 12:16:47 2010 -0500
IP: 62.193.238.150 (FR/France/wpc2131.amenworld.com)
Failures: 10 (pop3d)
Interval: 300 seconds
Blocked: Permanent Block

Log entries:

Oct 28 12:16:28 peregrine pop3d: LOGIN FAILED, user=admin, ip=[::ffff:62.193.238.150]
Oct 28 12:16:28 peregrine pop3d: LOGIN FAILED, user=admin, ip=[::ffff:62.193.238.150]
Oct 28 12:16:28 peregrine pop3d: LOGIN FAILED, user=admin, ip=[::ffff:62.193.238.150]
Oct 28 12:16:34 peregrine pop3d: LOGIN FAILED, user=test, ip=[::ffff:62.193.238.150]
Oct 28 12:16:34 peregrine pop3d: LOGIN FAILED, user=test, ip=[::ffff:62.193.238.150]
Oct 28 12:16:34 peregrine pop3d: LOGIN FAILED, user=test, ip=[::ffff:62.193.238.150]
Oct 28 12:16:39 peregrine pop3d: LOGIN FAILED, user=info, ip=[::ffff:62.193.238.150]
Oct 28 12:16:40 peregrine pop3d: LOGIN FAILED, user=info, ip=[::ffff:62.193.238.150]
Oct 28 12:16:40 peregrine pop3d: LOGIN FAILED, user=info, ip=[::ffff:62.193.238.150]
Oct 28 12:16:45 peregrine pop3d: LOGIN FAILED, user=root, ip=[::ffff:62.193.238.150]


if you skim through it you see an IP address from France tried a number of times to login to the server using a dictionary attack - it kept trying random usernames and passwords hoping to find a weak point and get access

You can see they tried the users
admin
test
info
root

In this case they are trying to get access to the mail server ( pop3) - most likely so they can send spam from a server in the US ...

after 10 failures in a short interval they were blocked

I hope this helps

I know some of it may not make sense to the non geeks in the crowd - just skim over that .. ;-)

[SID210SA]

Thats pretty neat.....never knew how that worked....thanks. By the way....are you gonna make it out to Centerville this year???

[Zack]

www.youhide.com is a temporary fix to being blocked.

[PonyUP]

I wonder if it is an IP problem if you did the following it would work

In the DOS cmd prompt type

ipconfig (this will bring up your current IP address)
then hit the up arrow (this will bring ipconfig again)
This time add / renew on the end
This should refresh your IP address

[magindat]

I wonder if it is an IP problem if you did the following it would work

In the DOS cmd prompt type

ipconfig (this will bring up your current IP address)
then hit the up arrow (this will bring ipconfig again)
This time add / renew on the end
This should refresh your IP address

That'll only get you a new IP Addy behind your router. Router public IP stays the same. Assuming you're running DHCP behind the router.

You'd have to get a renew from your ISP.

If his internal network is blasting stuff he doesn't know about, he's got some malware infection he needs to handle on one or more of the machines.

[silver_2000]

yep its the EXTERNAL ip that needs to change

turning off the cable modem or router is the only way to try to do that in most cases

ipconfig only changes the internal address from the router

[PonyUP]

Good tips and good to know

[silver_2000]

If his internal network is blasting stuff he doesn't know about, he's got some malware infection he needs to handle on one or more of the machines.
The chance that he infected with malware that was posting pictures of Marauders to a marauder site is pretty small - REALLY SMALL

more likely he was trying to post a link to the picture or quote some one that did and the combination of characters that resulted looked bad to the server