Difficultly accessing forum

[geomannie]

Hi

I am experiencing difficulty in accessing the forum, the connection request generally failing. The issue seems worse when I try to connect via my broadband router than mobile connection.

Are you aware of a problem your end?

Thanks

[admin]

No obvious problems this end. Is it only this website that you're having trouble with?

[geomannie]

Hi

Yes, only this website. Has my IP address perhaps been added to a block list you are using, one that has been recently updated?

Just a thought.

PS, connection on mobile network seems fine.

Cheers

[admin]

What is your current internet IP address?

If you were blocked by IP address you wouldn't be able to get to the Forum at all.

[geomannie]

On mobile I get 92.40.193.143

On home WiFi I get 149.5.50.10 which is shown as belonging to my ISP Brillband, Cogent Communications LLC

So quite different addresses thus i suspect an IP address issue. To be clear I can only connect via mobile only.

[admin]

Aha, sorry, that somehow got added to a blocklist of Forum scraper robots supposedly in the USA.

Should be better now?

[geomannie]

Thanks! All working well now.

Can I ask who supplies you with the block list? It comes to mind that a couple of other sites are recently giving me trouble and I'm suspicious that my IP address is being listed by someone as dodgy. The only thing I routinely do is block trackers - maybe that is enough to be deemed suspicious?

If you could point me to who compiles your blocklist I could take it up with them.

Thanks

[admin]

I construct my own block lists, based on Forum visitor IP addresses and geolocation data. The latter is not 100% correct, which is why my system thought you were in the USA. Probably because Cogent are a US company.

Your IP address looks OK at the moment:

https://dnschecker.org/ip-blacklist-che ... 49.5.50.10

[slowster]

I think the problem might be that Brillband has leased a relatively small range of IP addresses from Cogent. Consequently when bot attacks are made using Cogent IP addresses in the US, the block that admin imposes inevitably includes the Brillband's IP addresses within the larger range.

AIUI, there is no simple resource that can be used to identify 'sub-let' ranges in order to be able to exclude them from high level blocks. It is possible to check an individual IP address, and sometimes, as in this case, it is possible to see that the address is recorded against more than one ISP:

https://bgp.tools/prefix-selector?ip=149.5.50.10

From the little I have read, Cogent are a huge player, and provide/lease IP addresses to some of the biggest US ISPs, including Comcast and Charter Communications, as well as presumably to many others. We see plenty of use of those IP addresses by spammers, and I presume that admin also sees a lot of the bot attacks from them. Unfortunately blocking them is necessarily a largely blunt tool. Any small IP address ranges belonging to ISPs like Brillband are likely to be affected by a wide ranging block unless and until admin is made aware of it and is able to identify the range and whitelist it.

I am partly guessing this is what happens with the blocks imposed by admin, but this is what happens with blocks at the forum software level on VPNs etc. used by spammers. For example, the ISP Community Fibre has many small separate ranges of IP addresses, and many of them are sequentially adjacent to very large ranges belonging to VPN providers which are heavily used by spammers. As a result on several occasions a ban on a VPN range has inadvertently included IP addresses belonging to Community Fibre. If and when we get a message from a Community Fibre customer asking why they have been blocked, we can then identify the range and whitelist it.

a couple of other sites are recently giving me trouble

If they are doing something similar, I would expect that in due course they too would whitelist the Brillband IP address range. In other words, I think it should likely only be a relatively short term problem which happens when IP addresses have recently been leased/allocated to a different ISP.

To be clear, I am no expert on this, and the above is just my limited understanding based on what I have gleaned and intuited over the last couple of years, and I might be completely mistaken about some aspects.

[geomannie]

Thanks!

I am hugely indebted to you for sharing the benefit of your knowledge. If you don't mind I will forward a summary of your explanation to my ISP Brillband and see if they can do anything to get the IP address(es) whitelisted.

Kind regards

geomannie

[slowster]

If you don't mind I will forward a summary of your explanation to my ISP Brillband and see if they can do anything to get the IP address(es) whitelisted.

Firstly, when I said "If they are doing something similar", that is a very big "if", and I could well be wrong, in which event you would be starting on the wrong foot in your approach to your ISP.

Secondly, I think the ISPs like Brillband and Community Fibre etc. have very little ability, if any, to influence matters. I cannot see them contacting numerous third parties and trying to find out whether their IP addresses happen to be blocked, if so why, and what could be done about it. Bear in mind that admin, for example, is probably adding and removing blocks on a fairly reactive basis to the attempts being made to attack this forum at any given time.

I think you would do far better to contact the other websites which have been giving you problems, in the same way that you contacted admin/us by starting this thread. If (I say again, big "if"), they are doing something similar (in which case I presume they are a forum or similiar with vulnerability to DDoS/bot attacks), then the fix is in their hands. I would not even ask them if Brillband was blocked because the IP addresses were a subset of a much larger range belonging to Cogent. If that is the case, they will know/quickly realise it themselves and will not need to be asked. If it is not the case, you will probably just confuse matters and just be told that is not the reason (without getting it fixed).

In short, just ask them and see what they say.