[Misc] Strange happenings this morning / Banned IP addresses

Bozza

You can change this

Helpful Moderator

Jul 4, 2003

55,703

Back in Sussex

• Oct 9, 2015

• #1

Something strange going on with NSC this morning.

Some people were struggling to get logged in so I took a quick look and it appears that NSC was possibly being attacked and as such all logins were being blocked.

I did some SQL jiggery pokery which resolved the logging in issue and, as a precaution, I blocked the single IP address that all the traffic was coming from.

My email is now getting flooded with people complaining they have been blocked from NSC due to their IP address. So, it seems, that everyone visiting NSC at the moment is presenting the same IP address which means...

1. If I block it, everyone is blocked.
2. If people fail their logins, it counts as fails for everyone, since everyone looks the same due to the IP address being presented. To the software this looks like an attacker trying multiple usernames and passwords to try to get in.

I've unblocked the IP address now, but people may still experience login issues. As I've made no changes, I can only assume that maybe the hosts have made a change somehow. I'll look into it later.

 

Thunder Bolt

Silly old bat

Aug 18, 2009

65,395

Beside the seaside, beside the sea

• Oct 9, 2015

• #2

I got that but also have had a phone call from Tom Hark Preston Park because he can't log in at all.

 

Man of Harveys

Well-known member

Jul 9, 2003

18,734

Brighton, UK

• Oct 9, 2015

• #3

I thought it was something I'd said :0(

 

8ace

Banned

Jul 21, 2003

23,811

Brighton

• Oct 9, 2015

• #4

test

 

Yoda

English & European

Mar 1, 2004

10,056

Worthing, West Sussex, United Kingdom

• Oct 9, 2015

• #5

I was worried we had a breech of security at work. I'm on an NHS pc.

 

Bozza

You can change this

Helpful Moderator

Jul 4, 2003

55,703

Back in Sussex

• Oct 9, 2015

• Thread starter
• #6

Yep - everyone is hitting NSC from exactly the same IP address for some reason. Bizarre.

 

fat old seagull

New member

Sep 8, 2005

5,239

Rural Ringmer

• Oct 9, 2015

• #7

Me too, but thought 'damn I've finally been rumbled'! However all is now ok

Well apart from a rather unusual 'MI5 vacancy ad' blinking away at the bottom of the thread ?

 

Gullflyinghigh

Registered User

Apr 23, 2012

4,279

• Oct 9, 2015

• #8

Ah that would explain the Tapatalk weirdness this morning, for a horrifying moment I thought it no longer worked on NSC.

 

S

severnside gull

Well-known member

May 16, 2007

24,540

By the seaside in West Somerset

• Oct 9, 2015

• #9

Ooh. To think I share an IP address with NSC's great and good. Cool.

 

beorhthelm

A. Virgo, Football Genius

Jul 21, 2003

35,287

• Oct 9, 2015

• #10

Bozza said:

Yep - everyone is hitting NSC from exactly the same IP address for some reason. Bizarre.

Click to expand...

reverse proxy? is the IP in your hosting company's IP range?

 

StonehamPark

#Brighton-Nil

Oct 30, 2010

9,773

BC, Canada

• Oct 9, 2015

• #11

I'm back in!

Woohoo!

Felt very lonely peering in from the outside.

 

Bozza

You can change this

Helpful Moderator

Jul 4, 2003

55,703

Back in Sussex

• Oct 9, 2015

• Thread starter
• #12

beorhthelm said:

reverse proxy? is the IP in your hosting company's IP range?

Click to expand...

I suspect it's something like that. I haven't been able to quickly find the owner of the IP address (day job) but I've raised a ticket with Rackspace - they tend to be quick.

 

Tom Hark Preston Park

Will Post For Cash

Jul 6, 2003

70,131

• Oct 9, 2015

• #13

Able to login now cheers [MENTION=6886]Bozza[/MENTION]

 

ditchy

a man with a sound track record as a source of qua

Jul 8, 2003

5,208

brighton

• Oct 9, 2015

• #14

Putin was on here,after chatting with Ed Snowden , just checking the thread about Syria and "clocking" all those who were against

 

Titanic

Super Moderator

Helpful Moderator

Jul 5, 2003

39,057

West Sussex

• Oct 9, 2015

• #15

Bozza said:

Yep - everyone is hitting NSC from exactly the same IP address for some reason. Bizarre.

Click to expand...

So have the hosts implemented some sort of firewalling/natting/proxy? The IPaddr my browser is targeting for northstandchat.com is 98.129.229.50... this the address seems to route through loads of hops in the 'rackspace' world, the last of which are...

22 133 ms 133 ms 133 ms po1.corea-core10.core10.dfw3.rackspace.net [74.205.108.49]
23 137 ms 137 ms 136 ms core10-aggr170b-2.dfw3.rackspace.net [67.192.88.151]
24 136 ms 137 ms 136 ms 98.129.229.50

What is the address that client connections are appearing on... perhaps the subnet it belongs to will be a clue as to who is doing it??

 

Thunder Bolt

Silly old bat

Aug 18, 2009

65,395

Beside the seaside, beside the sea

• Oct 9, 2015

• #16

Love the tag line #bozzaout.

Own up, who did it?

 

fat old seagull

New member

Sep 8, 2005

5,239

Rural Ringmer

• Oct 9, 2015

• #17

Thunder Bolt said:

Love the tag line #bozzaout.

Own up, who did it?

Click to expand...

Woz Entmee ?

 

Foul Play Rocks

Well-known member

Feb 23, 2013

5,180

• Oct 9, 2015

• #18

I'm back in too. All is right in my little world again.

 

H

halbpro

Well-known member

Jan 25, 2012

2,860

Brighton

• Oct 9, 2015

• #19

Titanic said:

So have the hosts implemented some sort of firewalling/natting/proxy? The IPaddr my browser is targeting for northstandchat.com is 98.129.229.50... this the address seems to route through loads of hops in the 'rackspace' world, the last of which are...

22 133 ms 133 ms 133 ms po1.corea-core10.core10.dfw3.rackspace.net [74.205.108.49]
23 137 ms 137 ms 136 ms core10-aggr170b-2.dfw3.rackspace.net [67.192.88.151]
24 136 ms 137 ms 136 ms 98.129.229.50

What is the address that client connections are appearing on... perhaps the subnet it belongs to will be a clue as to who is doing it??

Click to expand...

Rackspace or something to do with Cloudflare is my guess without having more info. Think NSC still uses Cloudflare?

 

¡Cereal Killer!

Whale Oil Beef Hooked

Sep 13, 2003

10,197

Somewhere over there...

• Oct 9, 2015

• #20

Why does my Tapatalk say I am banned? It has said that for a few months at least now. I am still able to post though.