Single IP address blocked?

Ish · 10 Mar 2021 at 10:22

Hi

Over the last week or so we are unable to access the IP address 151.106.32.72 which is a GoDaddy server that our websites are hosted on from our office,

We have a VMB leased line and a Draytek 2927 router. There are no firewall rules setup to block this IP on our side.

nslookup of ourwebsite.co.uk will bring up the IP address above but trying to ping the IP address above times out. Also trying to access our website via the domain name gives a this site cannot be reached page.

If not using our internet connection everything works fine.

Is there anything else I sould be checking?

ChrisD. · 10 Mar 2021 at 10:24

Have you tried a trace route?

Ish · 10 Mar 2021 at 10:38

This is what the tracert shows:-

From office

Code:

Tracing route to ns31236811.ip-151-106-32.eu [151.106.32.72]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.1.1
  2     1 ms    <1 ms    <1 ms  m41.40.254.62.static.virginmediabusiness.co.uk [62.254.xx.xx]
  3     2 ms     1 ms     1 ms  perr-metnet-4a-pw-58.network.virginmedia.net [213.104.219.145]
  4     2 ms     9 ms     9 ms  perr-core-2a-ae18-3006.network.virginmedia.net [82.8.107.89]
  5     *        *        *     Request timed out.
  6    12 ms    11 ms    11 ms  86.85-254-62.static.virginmediabusiness.co.uk [62.254.85.86]
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11    17 ms    16 ms    17 ms  be101.rbx-g2-nc5.fr.eu [213.251.130.102]
 12    23 ms    23 ms    23 ms  be104.fra-fr5-sbb2-nc5.de.eu [94.23.122.241]
 13    24 ms    24 ms    24 ms  vl1229.fra1-lim1-d2-a75.de.eu [94.23.122.247]
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

From home (VM connection)

Code:

Tracing route to ns31236811.ip-151-106-32.eu [151.106.32.72]
over a maximum of 30 hops:

  1     9 ms     5 ms    10 ms  192.168.0.1
  2    16 ms    16 ms    17 ms  10.53.39.57
  3    15 ms    23 ms    12 ms  perr-core-2b-xe-206-0.network.virginmedia.net [82.2.242.89]
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6    21 ms    20 ms    22 ms  m686-mp2.cvx1-b.lis.dial.ntli.net [62.254.42.174]
  7     *        *        *     Request timed out.
  8    28 ms    22 ms    19 ms  uk-lon01b-ri1-ae-25-0.aorta.net [84.116.136.102]
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13    27 ms    25 ms    23 ms  be101.rbx-g3-nc5.fr.eu [54.36.50.241]
 14    32 ms    36 ms    33 ms  fra-fr5-sbb1-nc5.de.eu [54.36.50.242]
 15    34 ms    35 ms    37 ms  be101.fra1-lim1-g1-nc5.de.eu [91.121.215.117]
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20    37 ms    35 ms    29 ms  ns31236811.ip-151-106-32.eu [151.106.32.72]

ChrisD. · 10 Mar 2021 at 10:46

Bizarre, it's leaving VMs network on both connections.

Ish · 10 Mar 2021 at 12:09

I have reported it to both VMB and GD so will see what they say.

On Holiday · 11 Mar 2021 at 00:53

It's a cPanel server and the traceroute gets as far as the last router before the server so it's clear you've been blocked by the server. Could be for multiple failed login attempts to any service, i.e. cPanel, webmail ftp, IMAP/POP, Wordpress logins etc.
GoDaddy should be able to see that and resolve it within seconds, if not, you need a better hosting provider

Certainly not a network issue by any means and the difference in hops at 12/13 are just down to how OVH (the provider of the Godaddy server) balance traffic internally.

Deleted member 77746 · 11 Mar 2021 at 07:15

Blocked by GoDaddy probably their firewall. It will be automatic for something like flood or failed login attempts.

Give them your external IP. Will be unblocked as soon as you tell them.

Ish · 11 Mar 2021 at 12:16

Thanks for all the advice.

GD said the issue was not on their side but VMB said "Our Hostmasters have confirmed that these IPs were Blacklisted by a Third Party; the traffic was being blocked due to this. We have requested that the Blacklist be removed; this can take up to 24 hours to come into effect."

On Holiday · 11 Mar 2021 at 14:17

Ish said:
Thanks for all the advice.

GD said the issue was not on their side but VMB said "Our Hostmasters have confirmed that these IPs were Blacklisted by a Third Party; the traffic was being blocked due to this. We have requested that the Blacklist be removed; this can take up to 24 hours to come into effect."

Sounds very odd that VMB have blocked an IP address entirely. Specifically an IP address that only hosts 7 domains. Looks like it may even potentially be a dedicated server for your own use - do you have root access?

I could understand them blocking mail from the IP for detecting spam but not entire access. Especially as it's a webserver provided by GoDaddy.

You might want to chase up with VMB for the original reason for it being blocked to determine if there's an issue with malicious content or traffic being seen from the webserver. Or at least determine if the IP address just happened to be part of a larger more widespread block.

Ish · 12 Mar 2021 at 10:34

New reply from VMB. We have also gone back to GD about the block reason as well.

"The IP was on the TrendMicro Blacklist, and was only the 62.254.xx.xx IP. I will ask why this was added to the Blacklist and get it double-checked."

Ish · 12 Mar 2021 at 13:31

GD finally whitelisted our IP which has fixed the issue but still doesn't explain how we ended up on the TM blacklist which seems to be a seperate issue. Will look in to this further.

Thanks for all the tips.