My IP address appears to have been blocked - What to do?

I have had the same IP address via Zen for over 10 years now which is very useful to me as I am required to have a static IP address for access to my secure network at the University I work at and various research databases and projects that I am working on.

This morning I have noticed that I can no longer access various websites (examples - tesco.com, sky.com, ebay.co.uk, cbc.ca) as I get an Access Denied 'You don't have permission to access "http://groceries.tesco.com/groceries/" on this server. Reference #18.d5d2dead.1620387505.2ffd2a0" - the reference number at the end isn't static and changes with a refresh.

If I attempt to connect to any of these sites via 4g on my phone they work fine, switch wifi on my phone (i.e. direct the traffic via Zen) and it is back to access denied. Connecting via the University secure VPN (traffic via JANET) and the sites work fine again.

I've spoken to Zen and done all the usual things, flushing DNS cache, changing DNS, rebooting hardware and nothing worked.

Then Zen gave me access to a test username and password which took me away from my static IP address and on to another IP addresses and everything started working again.

Zen's tech support and my line of reasoning suggests that it looks like my IP address has been blocked somehow and all they can suggest is getting a new static IP. Before I do this, however, is there anything else I could try or even find out how my IP address has come to be blocked and by whom? I'd rather not change IP address as I would need to contact a few different people to set things up again, so any suggestions would be gratefully received

How do you know whether your internet connection is working at all? Can you get a ping response from the sites that you mention?

Thank you for replying.

I know my connection is working as I'm using the connection right now to read your response and to write this reply

Not every single site is blocking me.

I can ping tesco.com absolutely fine,

Pinging tesco.com [156.154.240.85] with 32 bytes of data:
Reply from 156.154.240.85: bytes=32 time=14ms TTL=246
Reply from 156.154.240.85: bytes=32 time=14ms TTL=246
Reply from 156.154.240.85: bytes=32 time=14ms TTL=246
Reply from 156.154.240.85: bytes=32 time=14ms TTL=246

But I get the access denied message when I try to visit it.

So far, I've found that the following sites are blocking me

Tesco.com
Sky.com
Ebay.co.uk
cbc.ca

But there are bound to be more

In reply to a post by Michael_Chare:

How do you know whether your internet connection is working at all? Can you get a ping response from the sites that you mention?

If it was giving a blocked response to websites, but connecting to work then using work as a vpn to connect its clearly the IP that is blocked

Without googling its probably a content delivery network (cloudfare) that has had an issue with your IP, or more likely a very close one and blocked a range.

In reply to a post by Hewitt_Himself:

Without googling its probably a content delivery network (cloudfare) that has had an issue with your IP, or more likely a very close one and blocked a range.

Thank you for flagging that, is there anything I can do from my end to research this any further?

Check your IP reputation at one of the free online sites such as
https://mxtoolbox.com/blacklists.aspx
https://talosintelligence.com/reputation_center/lookup

This may shed some light.

NB if you have IPv6 be sure to check both your v4 and v6 addresses

Thank you for those links they were really helpful.

I've checked my IP address on both of them (v4 only as i don't have v6) and it comes up clean on both, so I don't seem to be on any blacklists.

Unless, that is, they aren't updated regularly, as I placed by grocery order on Tesco.com last night just after 10pm, so it was certainly working then and I didn't notice it wasn't working today and I was blocked until about 9.30am

In reply to a post by Spudgun:

I can no longer access various websites (examples - tesco.com, sky.com, ebay.co.uk, cbc.ca) as I get an Access Denied 'You don't have permission to access "http://groceries.tesco.com/groceries/" on this server. Reference #18.d5d2dead.1620387505.2ffd2a0" - the reference number at the end isn't static and changes with a refresh.

Hi, the websites you've mentioned all use Akamai. Have a look at Akamai's reputation checker.

https://www.akamai.com/us/en/clientrep-lookup/

https://community.akamai.com/customers/s/article/Why...

> dig +short www.cbc.ca
san.cbc.ca.edgekey.net.
e5220.e12.akamaiedge.net.
2.16.57.134
> dig +short www.tesco.com
www.tesco.com.edgekey.net.
e2008.x.akamaiedge.net.
23.195.134.84
> dig +short www.sky.com
www.sky.com.edgekey.net.
e1264.g.akamaiedge.net.
92.122.18.173
> dig +short www.ebay.co.uk
slot11847.ebay.com.edgekey.net.
e11847.g.akamaiedge.net.
88.221.42.201

Thank you - that has identified the problem exactly

Your IPv4 Address *redacted* received a bad risk score.

The IPv4 Address was associated with the following malicious activity:

Web Attacker

I've completed the form on their website to enable an investigation into this and hopefully they will be able to see that I've done nothing wrong.

Is there anything one might innocently do which would lead to one's public IP address being blacklisted by the likes of Akamai? Maybe clicking on a link in a 'Hello xxx' email generated by an app going through all the email addresses in someone's address book?

There are 5 devices on my lan

PC
Android tablet
Android phone
Sky HD
Nvidia shield

I've gone over the pc and Android devices today with a fine tooth comb and can see nothing odd in the running apps or processes and they are not sending any traffic that looks in the least bit strange. The AV (eset) is up to date on the pc, phone and tablet and the all security patches are up to date.

I can't really check the shield or sky box in the same way, but I'd be surprised if they would be an issue.

I reckon this must be an error of some kind on their database and zen think so too, so they are giving me a new IP address tomorrow. It will be a bit of a faff to update all my details next week and hopefully I've not missed anything here that will trigger blacklisting again.

In reply to a post by Spudgun:

It will be a bit of a faff to update all my details next week and hopefully I've not missed anything here that will trigger blacklisting again.

Hopefully you're aware that IP address authentication isn't a very good security measure, and you are able to layer additional security challenges as well. Most of my customers assume remote workers can't get a static IP, so the use of VPN technologies and strong authentication tools (e.g. certs & other forms of 2FA) is mandatory.

In reply to a post by jchamier:

In reply to a post by Spudgun:

It will be a bit of a faff to update all my details next week and hopefully I've not missed anything here that will trigger blacklisting again.

Hopefully you're aware that IP address authentication isn't a very good security measure, and you are able to layer additional security challenges as well. Most of my customers assume remote workers can't get a static IP, so the use of VPN technologies and strong authentication tools (e.g. certs & other forms of 2FA) is mandatory.

Thank you for your reply. Yes, I am aware of all of the above and my IP address is only 1 part of the authentication needed and there are other measures too, but I'll need to spend quite a bit of time next week changing things over and going through various forms of security to get the changes authorised.

Well you don't have very many devices!

As a regular user of Tesco and ebay I would not be pleased if they refused to let me connect, though I can change my public IP address quite easily. It would be annoying if this was caused by a future grandchild.

I would be very interested to know what Akamai have to say and how quickly they can stop blocking you.

I hope you manage to get the issue sorted out.

Thank you. They say that they will get back to you within 2 working days, so I'm hoping for a reply by Tuesday and I will let folks here know what they say so this thread can act as a resource for people facing the same issue in the future.

I am wondering if they saw malware from addresses in the same subnet as yours and took a sledgehammer to it and blocked the whole of a subnet rather than individual addresses.

That is certainly possible. Zen have given me a new static IP address today and all of the blocked websites are now functioning again.

No response from Akamai in relation to their investigation at the moment

In reply to a post by jchamier:

Hopefully you're aware that IP address authentication isn't a very good security measure, and you are able to layer additional security challenges as well. Most of my customers assume remote workers can't get a static IP, so the use of VPN technologies and strong authentication tools (e.g. certs & other forms of 2FA) is mandatory.

For what I might call high impact accounts aka compromise my account at work and that could be the universities HPC system and it's backup gone in a few minutes if you knew what you where doing, then limiting the IP's from which access can be gained is another useful layer of security. Defence in depth is the principle being deployed. There is only three IP addresses in the world from which 99.999% of the time access the system. My desktop at work, from my home, and from my mothers home. They are all static IP's. If I am not on one of those IP's step one is to put myself on one of those IP.

Actually strictly that's no true, there is a console server in the data centre with a physical KVM, but if you have physical access it game over anyway. Managing the system actually requires getting access to that machine first.

Despite promising a response to any investigations about potential mistakes in their flagging activities in 2 working days, Akamai have not responded in 4 working days.

It's pretty rubbish that they can flag someone on their systems that sees them blocked on a range of popular websites when they do not respond to enquiries about this in a timely manner despite their promises to do so.

I feel that they should be accountable for their actions and I'm a bit miffed that I had to change my IP address of over 10 years having undertaken no actions whatsoever that could result in my IP address being blacklisted.

I am most grateful for all of the support of this community in getting to the bottom of this, and should Akamai ever respond and account for their actions I will update this thread in case it is of any use to anyone else facing a similar predicament in the future.

It is now more than a week after the suggested deadline of a 2 working day response time from Akamai and nothing has been received in response to their investigation into this.

So, in short, if this ever happens to you, you are completely stuffed and people can block your access to popular websites without any accountability for their actions and there is nothing you can do about it other than switch your IP address

I don't suppose you know (or care now) if the original IP address was ever remediated?

Perhaps it was and they have simply failed to follow up the paper trail?I wouldn't expect it would remain blocked forever, and at some point the ISP that owns it would have to demand it was cleared.

In reply to a post by Pheasant:

I don't suppose you know (or care now) if the original IP address was ever remediated?

Perhaps it was and they have simply failed to follow up the paper trail?I wouldn't expect it would remain blocked forever, and at some point the ISP that owns it would have to demand it was cleared.

That's a fair point, I know what my old IP address was, but I can't seem to find a way to check whether that address is still flagged by Akamai as it only seems to use the address from which you are currently connecting from.

If anyone knows of a different way to do this please let me know and I will be more than happy to check

A note for the future - you aren't Akamai's customer, the sites in question are. So you might have more luck raising an issue with Tesco and saying that it's preventing you from ordering hundreds of pounds of food each month, which should then get it taken more seriously.

In reply to a post by Spudgun:

It is now more than a week after the suggested deadline of a 2 working day response time from Akamai and nothing has been received in response to their investigation into this.

So, in short, if this ever happens to you, you are completely stuffed and people can block your access to popular websites without any accountability for their actions and there is nothing you can do about it other than switch your IP address

Akamai are quite upfront about the fact that they will not unblock you.

In reference to community.akamai.com/customers/s/article/Why-is-Akamai-blocking-me?...:

If you are unable to access a web site, this may be the result of a policy configured by the site owner you are attempting to access. To make a change to this policy, the site owner (the Akamai customer) would have to change their policy. Akamai is unable to make this change without the explicit direction of the site owner. To obtain the contact information for a site owner, one avenue to explore might be via whois. Please contact the site owner directly and have them in turn contact Akamai if they believe that you should be able to access the resource.

To reiterate, Akamai is unable to make this change without the explicit direction of the site owner.

You need to contact the sites that have you blocked and have them remove the block or have them contact Akamai on your behalf.

Edited by j0hn83 (Thu 20-May-21 10:39:32)

That does have the unfortunate consequence that once you have entered Akamai's blacklist (whether rightly or wrongly) you have to contact every site owner who subscribes to Akamai's services to try and have your access restored.

I suspect m'learned friends could have some fun if there has been an error an Akamai's part leading to an incorrect black-listing causing someone to suffer a material loss.

In reply to a post by GonePostal:

That does have the unfortunate consequence that once you have entered Akamai's blacklist (whether rightly or wrongly) you have to contact every site owner who subscribes to Akamai's services to try and have your access restored.

I suspect m'learned friends could have some fun if there has been an error an Akamai's part leading to an incorrect black-listing causing someone to suffer a material loss.

You don't have to contact them all.

It only needs a single site that has you blocked to contact Akamai.
Akamai will then make the changes to unblock you, which will filter to every other site.

Whilst I acknowledge everything that you are saying, that means that this on Akamai's site is completely meaningless -

"You can use our Client Reputation lookup application at https://www.akamai.com/us/en/clientrep-lookup/ to check whether your connecting IP address received a bad reputation score and submit an investigation request in case you believe it was mistakenly flagged as malicious."

If you go to that address from an IP that is blacklisted you can go to a separate page where you can request an investigation that they say they will get back to you in 48 hours with - which in my case is now overdue by 6 working days.

Essentially, Akamai are producing conflicting information on their website and are completely full of it as they don't investigate (or at least don't reply) and you are completely stuffed if they falsely and mistakenly add you to their blacklist.

Thanks for the clarification. I was going by your comment:

"You need to contact the sites that have you blocked and have them remove the block or have them contact Akamai on your behalf. "

Edited by GonePostal (Thu 20-May-21 12:08:36)