Re: Web Site blocked as hostile. Not sure if this is correct or not

[Adolf Belka <adolf.belka@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2100 bytes --]

Hi Peter,
Searched in the spamhause drop.txt file and there is only one network 
range that starts with 107 and that is

107.182.240.0/20 ; SBL390277

Peg Tech Inc are using 107.148.0.0/15 so definitely not in the range of 
any of the spamhaus drop IP's.

Just checked the spamhaus edrop list and that has IP ranges that no 
closer to not covering Peg Tech Inc.


Based on the above I think I am coming to the conclusion that the 
problem in bug#13236 is also causing this problem but where, when libloc 
is updated the hostile networks flag is set on this IP range even though 
neither of the spamhaus drop lists include it.

I think I will add it as additional input into the bug#13236 report 
later on today.

Regards,
Adolf.

On 15/08/2023 15:37, Adolf Belka wrote:
> Hi Peter,
>
> I am getting a DROP_HOSTILE for a web site, oldlinux.org
>
> Looking in libloc it shows up as hostile
>
> location lookup 107.148.241.134
> 107.148.241.134:
>   Network                 : 107.148.0.0/15
>   Country                 : United States of America
>   Autonomous System       : AS54600 - PEGTECHINC
>   Hostile Network safe to drop: yes
>
> However in spamhaus it says that oldlinux.org and 107.148.241.134 have 
> no issues.
>
> I ran a couple of blacklist checkers on the ip.
> blacklistchecker.com came back with a pass on everything.
> dnschecker.org came back with a pass on everything except from 
> dnsbl.spfbl.net who have it flagged because it doesn't have an rDNS
>
> With the problems we are having currently with selective announcements 
> of networks, I wasn't sure if this problem I have encountered is 
> coming from the libloc database or is a real problem.
>
> oldlinux is hosted on the network from Peg Tech Inc hosting so maybe 
> they are a hoster of hostile networks but I don't know how to confirm 
> this.
>
> I wasn't sure about raising a new bug on this, or adding it to 
> bug#13236, in case it was a real hostile network and should be blocked.
>
>
> Hoping you can help me with this.
>
> Regards,
>
> Adolf.
>

-- 
Sent from my laptop