Here's the latest update from me as the OP.

In case it's relevant, I should say that I'm on Zen FTTC and OpenReach (full fibre to my premises isn't - yet - available, so no CityFibre or alternative network.

First, the overnight power-off of my Zen router. As identified by the whatsmyipaddress website, the external IP address I had was (IPv6) 2a02:8012:e66b:xxxx:xxxx:xxxx:xxxx:xxxx, and/or (IPv4) 77.104.xxx.xxx.

This morning I switched the router back on, and the IP address was the same as before. I don't know whether that means Zen sets a static IP address for each customer, or whether this is a "sticky" dynamic one that happens not to have changed. I might ask Zen....in case I ever need to ask them to change it.


It is interesting that those other Zen customers who have replied to @pheasant's question, and who have been able to access the fiero.nl site without difficulty, are on IP addresses from Zen's other ranges.

I have also had a further response, and indeed a solution to the original problem, from the fiero.nl website admin (who I might say has been very helpful throughout). The message I got from him this morning is self explanatory:
"I think I found the culprit. It wasn't that your specific IP address was blocked, but an entire range of IP addresses where yours falls under. Someone with an IP address within that range tried suspicious things on my server and was automatically blocked by the server. I've removed that block so you should be able to reach the forum again."

And sure enough, I can now once again access the fiero.nl website and forum easily and immediately.

All of which goes to confirm the rather scathing comment in an earlier post by @DFScale that

"IP bans are largely stupid, because:

IP banning a CGNAT address means banning hundreds of people on the ISPs public IP address, all but one of whom are innocent
IP banning a dynamic address means banning other innocent people who might get the same address over the days weeks, months and years ahead
IP banning a static address means banning the innocent people who get that address, when it goes to a new customer after the original offender changed ISP".

Clearly I had difficulty in accessing that specific website because someone else on a different IP address from the same Zen range did something inappropriate which triggered a ban on the entire range of IP addresses.

I'm pleased and relieved that the problem is sorted; and in the process I have learned a lot. I just hope it never happens to me again.

Meanwhile, sincere thanks to all who have joined in the discussion and helped to clarify what was initially for me a baffling and unwelcome problem.

Seems their server took a bit of a sledgehammer to fix the "problem". By blocking a range of addresses they blocked users that were not part of the mis-deed. For a small site it may be a reasonable risk as the chances of others connecting from the same range are probably quite low - you were unlucky to be one of them.

Glad you got it sorted and seems the solution was what was expected very early days. Zen couldn't have done anything to resolve the issue and if they had to contact every 3rd party provider that might have blocked an IP of theirs then they wouldn't get anything else done - I can't think of many providers that would have done this for you although some of them might have given you more pointers to getting it resolved - in reality though Zen gave you the right advice).

As far as your IP whether it is very sticky or static results in pretty much the same - if you always get the same IP then it is essentially static no matter how they deliver it. At least now you know and I suspect you now know quite a bit more about IP networks than you probably ever wanted to

Glad you got it sorted

Thanks for coming back, br1anstorm. It's a good result and thanks for letting us know.

Yes, my comment was rather scathing and I would concede that some forms of activity can only be dealt with by IP blocks - for example Denial of Service [DoS] attacks. Often the owner of the machine can be unaware of the attacks because their machine has been taken over as part of a botnet

Even in these cases, I think that any IP ban should be time limited, [a month? 3 or 6 months?] because bad actors tend never to stay in one place for long, often because their ISP tells them to move on, or the botnetted customer cleans up their machine. The permanent IP ban then leaves others to suffer the consequences deep into the future.

In reply to a post by br1anstorm:

It is interesting that those other Zen customers who have replied to @pheasant's question, and who have been able to access the fiero.nl site without difficulty, are on IP addresses from Zen's other ranges.

I have also had a further response, and indeed a solution to the original problem, from the fiero.nl website admin (who I might say has been very helpful throughout). The message I got from him this morning is self explanatory:
"I think I found the culprit. It wasn't that your specific IP address was blocked, but an entire range of IP addresses where yours falls under. Someone with an IP address within that range tried suspicious things on my server and was automatically blocked by the server. I've removed that block so you should be able to reach the forum again."

And sure enough, I can now once again access the fiero.nl website and forum easily and immediately.

Great. 👍

Sounds like the server auto blocked the 77.104.128.0/18 range your IP address was part of. Hence why folks on some other Zen ranges were able to connect.

As said, glad they came to the party and removed the block.

Thanks for circling back too.

In reply to a post by ian72:

Seems their server took a bit of a sledgehammer to fix the "problem". By blocking a range of addresses they blocked users that were not part of the mis-deed. For a small site it may be a reasonable risk as the chances of others connecting from the same range are probably quite low - you were unlucky to be one of them.

Perhaps but the logic is justifiable.

A couple of FreePBX / Asterisk boxes I’ve run over the years employ fail2ban which effectively does this. It works on a small scale deployment against bots and brute force attacks. Not always ideal, but it’s sometime better to have something which provides protection and limits complete server meltdowns and inconveniences the few for the benefit of most legitimate users.

I see from the wikipedia entry that Fail2ban generally does a time limited ban, with the initial levels being just a few minutes.

I think the default period was 24 hours, but don’t take my word for it. It’s been a while 😂

Hello again....

Just when I thought it was safe to go back online, it turns out that my announcement on Wed 19 Feb (see my last post above) that the problem had been resolved was a little premature!

As explained, the website owner/admin investigated why I was having problems accessing the site. He found that the website servers had identified the range of IP addresses which included mine as being "suspect", so had blocked them all automatically.

He was able to remove the block. So I thought all was well, and in fact was able to access and log in to the forum at www.fiero.nl again as normal.

It didn't last. 48 hours later, I found that - once again - I couldn't reach the site. So I contacted the website owner/admin again. And this was his reply, received today:
"It was the same problem; your ip address (or to be more precise, an entire range where your ip address is a part of) was automatically blocked again by my server. I removed the block so all should be well again but I suspect it will happen again because I found out *why* it's blocking the ip addresses: because the (external) location database thinks the ip address is from Bulgaria (which is a country that is blocked access to my server). I'm trying to get this fixed since this is obviously an error in the database, but I have no idea how long this will take. In the mean time, just let me know whenever you are blocked again and I will unblock the ip range.

This is clearly unsatisfactory and isn't a permanent fix.

We know - thanks to @pheasant's earlier posts and the replies from others - that Zen manages or assigns IP addresses from numerous different ranges. Mine is 77.104.xxx.xxx. Those Zen clients on other IP addresses have had no problems. But this particular range (or some addresses within it) , managed by Zen, a UK ISP, is apparently identified as being based in Bulgaria!

I have no idea how or why this is the case. But it is giving me (and indeed the fiero.nl site owner) continuing problems.

I am therefore aiming to contact Zen tech support to report all this and to request them to assign me a new IP address from a new and "clean" range that is correctly identified and listed as being managed by Zen in UK and not linked with dodgy actors in Bulgaria.

I hope they will agree.....

I have no idea how or why this is the case. But it is giving me (and indeed the fiero.nl site owner) continuing problems.

As there is a scarcity of IPv4 addresses, ISPs and other organisations regularly buy and sell block of addresses that they can then allocate for their own use / customers. These can previously come from anywhere in the world, they can be traded an infinite number of times in theory.

Unfortunately the past “baggage” and “geographic location” of these IP ranges can live on in various geo-location and other reputational databases, which aren’t always either kept up to date or completely accurate.

I am therefore aiming to contact Zen tech support to report all this and to request them to assign me a new IP address from a new and "clean" range that is correctly identified and listed as being managed by Zen in UK and not linked with dodgy actors in Bulgaria.

I hope they will agree.....

Definitely worth a shot. They should be able to assign you from a fresh subnet.