microgeek Posted September 8, 2012 ID:594960 Share Posted September 8, 2012 All of my sites(same hosting plan) are blocked, I have scanned with 6 scanning programs, and it shows up clean there.www.microhost.uswww.microgeek.mewww.host-elite.comIP: 184.171.164.226Can somebody please tell me why my site was blocked, along with unblock it? Thanks. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2012 ID:594970 Share Posted September 8, 2012 It's not an F/P, and not going to be unblocked.The IP is one of two blocked due to a proliferation of malicious content, courtesy of the likes of Astounding Host, with no response from the ASN that owns the IP. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2012 ID:594972 Share Posted September 8, 2012 Your post has been removed due to the presence of profanity.Please feel free to re-post, but leave out any and all profanity, as it is against our forum rules. Link to post Share on other sites More sharing options...
microgeek Posted September 8, 2012 Author ID:594974 Share Posted September 8, 2012 Your post has been removed due to the presence of profanity.Please feel free to re-post, but leave out any and all profanity, as it is against our forum rules.First off, can;t you edit posts? Anyways, so there is no way for my sites to be unblocked? This kinda sucks, because it will take me a load of time to transfer all of my domains to another host. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2012 ID:594975 Share Posted September 8, 2012 I can''t make an exception on a per site basis in this case, no. I'd suggest you move your sites to a more reputable host. Link to post Share on other sites More sharing options...
microgeek Posted September 8, 2012 Author ID:594976 Share Posted September 8, 2012 I can''t make an exception on a per site basis in this case, no. I'd suggest you move your sites to a more reputable host.Can you tell me what they where hosting? A tad bit curious, so I can fill my review of their service with some nice details. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2012 ID:594977 Share Posted September 8, 2012 Everything from drive-by's to phishing scams. Link to post Share on other sites More sharing options...
microgeek Posted September 8, 2012 Author ID:594981 Share Posted September 8, 2012 So there is no way to get this fixed without switching hosts? Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2012 ID:594983 Share Posted September 8, 2012 At present, I'm afraid so, yes. Untl the AS starts responding and suspends the host responsible, the IP will continue to be blocked. Link to post Share on other sites More sharing options...
AstoundingHost Posted September 9, 2012 ID:595059 Share Posted September 9, 2012 Hello,We deal with all abuse reports that come in and our data centre always forward reports to us promptly. I'll be moving forward with this enquiry since we take abuse and malicious content very seriously.Thank you. Link to post Share on other sites More sharing options...
AstoundingHost Posted September 11, 2012 ID:595722 Share Posted September 11, 2012 I've contacted our data centre over this and had the following back:Hello George,I apologize that your IP address has been blocked from MBAM. As you know we do not control the content hosted by your clients and have no affect on what malwarebytes considers a threat. You receive these notifications through our automated system. Our automated system scans all e-mails for Domain/IP Addresses then forwards them to the appropriate client. That is how you receive these notifications. I have looked through our Automated System application to search for any notifications on IP 184.171.164.226/and the domains in question, and the only domain in offense I found was for id-runescape.com(184.171.164.226) which you have already suspended. I have read the forum post and I quote " AS starts responding and suspends the host responsible." I do not see that you are in violation George. Perhaps one of your clients but I have not a shred of evidence to hold you against it. They did not exactly say malicious content was coming from those domains, rather the IP address. I woul d ask if they could clarify where this malicious content is still coming from and resolve it from there. If they are unwilling to provide evidence then I would assume it is a false positive. Please let me know if I can be of any further assistance, Regards,-- Chris N.Abuse Management SpecialistPhoenixNAP Abuse Departmenthttp://www.PhoenixNAP.com Can you clarify if the content is still around please? Link to post Share on other sites More sharing options...
MysteryFCM Posted September 11, 2012 ID:595769 Share Posted September 11, 2012 The case is currently being reviewed, and will be responded to shortly. Please allow up to 24 hours. Link to post Share on other sites More sharing options...
AstoundingHost Posted September 12, 2012 ID:596412 Share Posted September 12, 2012 It has been longer than 24 hours. Do you have an update? Link to post Share on other sites More sharing options...
AstoundingHost Posted September 20, 2012 ID:599149 Share Posted September 20, 2012 It's been 8 days now without a reply.. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 20, 2012 ID:599270 Share Posted September 20, 2012 My apologies for the delay. I've not forgotten about this, the investigation is still ongoing and is only one of hundreds I am currently dealing with.As much as I'd like it to be, this isn't a quick process, as everything needs re-checked, on every IP, including for example, verification that content appearing to have been removed etc, has actually been, and hasn't just been moved to a new location. My apologies for not making this clear.As an aside, I did notice, a domain involved in exploits/malware etc since its inception, moved from you today;ultimatecore.info Link to post Share on other sites More sharing options...
MysteryFCM Posted September 20, 2012 ID:599275 Share Posted September 20, 2012 As another aside, rather curiously, quite a few domains involved in malware, phishing, bot C&C's etc, and part of the investigation, are now suddenly showing as dead/suspended/moved (very curious given the length of time they were with you, and the fact they were very much present 24 hours ago).another one, has switched from a drive-by, to a dDOS service;runestream-live.comLess serious issues, include splogs and splorums, but these aren't the cause of the block. However, the following still need dealt with and suspended;microgeek.meforum.runescape.com.kgfjtech.usbolides09.comcelexameds.comcheapcialishere.comcheapestkamagrarx.comcheaplevitradeals.comI did also notice a domain used for drive-by's since its inception, inclusive of since its move to a new "owner" (img196-imageshack.us) has been mysteriously suspended as of the past 24 hours. Link to post Share on other sites More sharing options...
AstoundingHost Posted September 22, 2012 ID:599840 Share Posted September 22, 2012 The following have been suspended:runestream-live.comforum.runescape.com.kgfjtech.uscelexameds.comcheapcialishere.comcheapestkamagrarx.comcheaplevitradeals.comAs for microgeek.me and bolides09.com, I'm struggling to see what the issue actually is here. Link to post Share on other sites More sharing options...
AstoundingHost Posted September 22, 2012 ID:599971 Share Posted September 22, 2012 fjtech.us is unsuspended since I worked with the owner on this issue and the content has been removed. Hi,I understand the fact that you want to keep your servers clean to better serve your clients, but here in my case, my account was suspended because of file names which I think is not a really efficient thing to be based on.Pccontrol folder and command.php belong to a script I was developing which lets people control and share files from their computers to their mobile phones, the project was abandoned more than 8months ago due to technical problems.As for crypter.php, it is an offset and base 64 alphabet crypter which I used to crypt love messages and send them to my girlfriend, and then I challenged her to decrypt it. You can verify the code source of all these files to see that they don't have anything to do with DDOS or any illegal or harmful thing.Also I'm using my fjtech.us/localedu in google apps challenge 2012 and I could make it to the semi finals with my application hosted there. Now I can't access it anymore which will affect my ranking and standing. Thanks for understanding.Best Regards, Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now