From mboxrd@z Thu Jan 1 00:00:00 1970 From: Adolf Belka To: development@lists.ipfire.org Subject: Re: Web Site blocked as hostile. Not sure if this is correct or not Date: Tue, 15 Aug 2023 16:32:50 +0200 Message-ID: In-Reply-To: <2a4342e8-257b-4f3f-8ff0-c05031165f61@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8626223206963240581==" List-Id: --===============8626223206963240581== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Hi Peter, Searched in the spamhause drop.txt file and there is only one network range that starts with 107 and that is 107.182.240.0/20 ; SBL390277 Peg Tech Inc are using 107.148.0.0/15 so definitely not in the range of any of the spamhaus drop IP's. Just checked the spamhaus edrop list and that has IP ranges that no closer to not covering Peg Tech Inc. Based on the above I think I am coming to the conclusion that the problem in bug#13236 is also causing this problem but where, when libloc is updated the hostile networks flag is set on this IP range even though neither of the spamhaus drop lists include it. I think I will add it as additional input into the bug#13236 report later on today. Regards, Adolf. On 15/08/2023 15:37, Adolf Belka wrote: > Hi Peter, > > I am getting a DROP_HOSTILE for a web site, oldlinux.org > > Looking in libloc it shows up as hostile > > location lookup 107.148.241.134 > 107.148.241.134: >   Network                 : 107.148.0.0/15 >   Country                 : United States of America >   Autonomous System       : AS54600 - PEGTECHINC >   Hostile Network safe to drop: yes > > However in spamhaus it says that oldlinux.org and 107.148.241.134 have > no issues. > > I ran a couple of blacklist checkers on the ip. > blacklistchecker.com came back with a pass on everything. > dnschecker.org came back with a pass on everything except from > dnsbl.spfbl.net who have it flagged because it doesn't have an rDNS > > With the problems we are having currently with selective announcements > of networks, I wasn't sure if this problem I have encountered is > coming from the libloc database or is a real problem. > > oldlinux is hosted on the network from Peg Tech Inc hosting so maybe > they are a hoster of hostile networks but I don't know how to confirm > this. > > I wasn't sure about raising a new bug on this, or adding it to > bug#13236, in case it was a real hostile network and should be blocked. > > > Hoping you can help me with this. > > Regards, > > Adolf. > -- Sent from my laptop --===============8626223206963240581==--