homeworkshop.org.uk

It could be a DNS issue. I don't know for certain, but of you work through VPN won't you still use the same DNS server?

Given the multiple exits from a VPN IP address, wouldn't it be more likely to experience a block when using the VPN.

A while ago I used a tool to check DNS server responses using the free ones, such as Google's own. Not all the results were the same!

I think it was "DNS Benchmark" but not sure if had the facility to return IPs for a known website.

To be fair it does depend on how the VPN is configured and what software you use to establish the connection (assuming you do it from the computer directly and not on the router itself)

Also, if the IP Bob sees matches that which others have posted here, then that ought to rule out DNS issues.

(If you know the site IP, you can always try connecting to it directly with a url of http://192.168.1.254 etc or whatever the IP is. Note that will only work for larger sites that are not using shared web hosting. For smaller sites that may use one machine to serve multiple sites, you will need to do that by name otherwise the web server will not be able to work out which site's content you want. You can get round that by adding a line in your HOSTS file to map a name to an IP, and that will then take priority over a DNS lookup)

Only if you are using a termination point that is blacklisted - say for example the system you are talking to is geofenced, and your VPN service is terminated in a country that is excluded.

The larger UK ISPs are obliged to sign up to various block lists that are supposed to restrict access to content for reasons of abuse (child typically) or copyright infringement etc. Some may use crude IP blocks for some of that. So that can be one source of change.

Also larger sites may use DNS rotation to implement a form of load balancing - basically handing out one of a pool of addresses to spread the load around a number of servers - so again you may not get the same address on each lookup.

Just to follow up on this. I've heard back from Adam with this message. "Hi Bob, your IP address has been blocked by our security and firewall system because of suspicious behaviour coming from a device using that connection. I have removed the entry we should now allow you back on the site but as they have said if something else is using your connection to carry out this behaviour it will be blocked again. Below is the following entry from the log file; csf.deny: 80.7.35.195 # lfd: (mod_security) mod_security (id:949110) triggered by 80.7.35.195 (GB/United Kingdom/cpc76102-ando7-2-0-cust962.15-1.cable.virginm.net): 5 in the last 3600 secs - Mon Apr 5 10:58:17 2021"

I've no idea what I might have done to cause this and I don't really understand the log entry. Maybe my son is up to some mischief??

Bob

refreshing too often?

Other than continually pressing F5 which I don't, Ive no idea how to influence refresh rate. Bob

I have website on a shared server and before the DNS entries were updated to the name servers I think I was able to access the site with some user name after a given URL.

I wasn't aware of that, and thought censoring was carried with DNS lookups rather than blocking IP addresses.

There are sites that check DNS entries. This is one I came across that gives a timeout for some servers for the OP's website:

Probably nothing yourself...

You would need to see more of the log messages to form a proper opinion. mod_security (add on module for the Apache2 web server (and possibly others)) is designed to pick up on "unusual" patterns of traffic using a rule set. Those rules will then in some cases block access from a specific client IP if it is deemed a threat.

You may be able to trigger something by hitting pages that return enough "403 forbidden" errors. (i.e. manually editing URLs to try and real directories that are not intended to be readable by the web server)

Also many of the security rules will be setup to catch people running vulnerability scanners against the web server (e.g. for research before attempting to hack a server, a perp may run various scanners to see if they crash a server or get it to do other unexpected stuff by hitting it will lots of malformed requests, and attempts at buffer overflows etc.

So someone playing with hacking tools could do it, or alternatively a machine on the network that has been compromised and is now carrying out surrogate attacks for someone else.

If unsure, then running a Malwarebytes scan on all the machines would be worth doing (assuming all Windows or Macs).

Bob,

Most Mobile suppliers use Network Address Translation so many of there phones share the same IP address. I think folks who block by IP address are pissing into the wind. If you install IP Tools they will show you your internal and external addresses. If they are different you are "NATed" and many people will be sharing the address 80.7.35.195.

Dave

This is not a mobile supplier, so the rest of your post follows is irrelevant bollocks.

$ dig -x 80.7.35.195

; <<>> DiG 9.9.5-3ubuntu0.19-Ubuntu <<>> -x 80.7.35.195 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17671 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION: ;195.35.7.80.in-addr.arpa. IN PTR

;; ANSWER SECTION:

;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Apr 09 07:45:44 BST 2021 ;; MSG SIZE rcvd: 105

so many of there

No, they won't. In fact only one customer is.

Is it?

$ dig -x 82.132.247.28

; <<>> DiG 9.9.5-3ubuntu0.19-Ubuntu <<>> -x 82.132.247.28 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63021 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;28.247.132.82.in-addr.arpa. IN PTR

;; ANSWER SECTION:

;; Query time: 210 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Apr 09 07:47:28 BST 2021 ;; MSG SIZE rcvd: 93

It appears to actually be an O2 mobile address.

which is a real

No, its a real external address.

but my internal address is 10.66.37.232 which is a none

A non routed address. Its perfectly routeable, but by convention the internet at large, does not.

So many phones will sahre 80.7.35.195 and blocking it

A very little knowledge is a dangerous thing