My one site is blocked 84.45.45.134

[Gavin Baylis]

Just installed Malwarebytes on my fathers PC and my own site is blocked 84.45.45.134 gavinbaylis.com as I'm a website developer not the best thing to happen to me - other clients on the same server are of eg elainedeed.com carnemill.com and others - can this be unblocked - I presume this is the correvt place to notofy you?

[MysteryFCM]

The malicious content on this range has moved elsewhere, however, the specific IP you've mentioned is identified by ProjectHoneyPot as malicious, so I'd recommend you move your site(s) elsewhere.

[Gavin Baylis]

The malicious content on this range has moved elsewhere, however, the specific IP you've mentioned is identified by ProjectHoneyPot as malicious, so I'd recommend you move your site(s) elsewhere.

Sorry can you explain some more - are you saying my site is malicious in some way ?

Should I make the tech support staff at KNet hosting aware of this?

I just can't "move" the site - it's not that easy as I have contracts etc etc

[MysteryFCM]

It's not your site, no. 84.45.45.134 is a shared server, with many other sites residing on it. You may want to consider mentioning the ProjectHoneyPot listing to your host though, as it's likely either there's a compromised site on there, or a deliberately malicious site on there.

[Gavin Baylis]

It's not your site, no. 84.45.45.134 is a shared server, with many other sites residing on it. You may want to consider mentioning the ProjectHoneyPot listing to your host though, as it's likely either there's a compromised site on there, or a deliberately malicious site on there.

Been in contact with Project Honey Pot see response below

Looking at the report for that IP https://www.projecthoneypot.org/ip_84.45.45.134 there seems to be quite a bit of bad activity including spam with links that point to that IP and spam messages originating from that IP. The recent problem seems to be spam originating from that IP. If I had to guess I'd say you probably have a compromised form or user account on that system. You can whitelist the IP by visiting the report page for that IP from the same /24 and follow the whitelist link on the left.

So I have removed & deleted any old cgi forms on that server and my hosting company has done as Project HoneyPot have advised.

Hi Gavin,

I have done as they have suggested to whitelist the IP, although he block still seems to remain, I do not know if there is a delay between actioning the whitelist and it actually being removed.

I presume you will have to wait a few days to see if it's ok before removing the block?

Regards

GB

[MysteryFCM]

They'll delay it to prevent automated whitelisting and abuse of it (gives them time to check who and why, it was whitelisted and whether it actually should be or not)