cancel
Showing results for 
Search instead for 
Did you mean: 

212.159.9.91 - PlusNet home pages - blocked by McAfee

Superuser
Superuser
Posts: 10,023
Thanks: 1,562
Fixes: 19
Registered: 22-08-2007

212.159.9.91 - PlusNet home pages - blocked by McAfee

Why when I first logged into this new service has McAfee thrown a hissing fit and declared 212.159.9.91 a dangerous place to go?

This site is a dangerous place...This site is a dangerous place...

C:\Users\Kevin>ping -a 212.159.9.91

Pinging homepages.plus.net [212.159.9.91] with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.

 

11 REPLIES
Superuser
Superuser
Posts: 10,023
Thanks: 1,562
Fixes: 19
Registered: 22-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

Add this one - 62.161.94.230 - too whilst connecting to the forum...

#09/04/2016-20:38:52.79
C:\Users\Kevin>ping -a 62.161.94.230

Pinging logs1229.xiti.com [62.161.94.230] with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.
Community Veteran
Posts: 19,099
Thanks: 434
Fixes: 21
Registered: 31-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

Not sure about that 2nd one, you'll have to investigate a bit more to find out what's there. But I guess similar to the first one, it's related to the Plusnet Navbar (and possiibly it's links) and stuff that's being delivered as insecure content (http) whilst the forum is https.

Superuser
Superuser
Posts: 10,023
Thanks: 1,562
Fixes: 19
Registered: 22-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

I think this is more than a http vs. https issue.  The PlusNet IP address is designated as dangerous by McAfee - as things stand, pings to this address fail - will review this after a restart at some future point.

Community Gaffer
Community Gaffer
Posts: 12,861
Thanks: 677
Fixes: 64
Registered: 04-04-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

The Homepages IPs respond to pings from here (external DSL circuit and internal network):

C:\Users\mail>ping 212.159.9.91

Pinging 212.159.9.91 with 32 bytes of data:
Reply from 212.159.9.91: bytes=32 time=20ms TTL=51
Reply from 212.159.9.91: bytes=32 time=18ms TTL=51
Reply from 212.159.9.91: bytes=32 time=18ms TTL=51
Reply from 212.159.9.91: bytes=32 time=19ms TTL=51

Ping statistics for 212.159.9.91:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 18ms, Maximum = 20ms, Average = 18ms

Are you trying from an external connection? The servers have recently been moved behind new load balancers and they may be denying outside ICMP requests.

As to why the servers are seen as malicious, I'm not sure. Do you get the same warnings when visiting a website hosted on that platform?

If not, then it could well be the HTTP versus HTTPS thing.

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

Community Veteran
Posts: 19,099
Thanks: 434
Fixes: 21
Registered: 31-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

I don't know, so I'll ask, could you test the ICMP responses using a VPN?

Superuser
Superuser
Posts: 10,023
Thanks: 1,562
Fixes: 19
Registered: 22-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee


bobpullen wrote:

Are you trying from an external connection? The servers have recently been moved behind new load balancers and they may be denying outside ICMP requests.

As to why the servers are seen as malicious, I'm not sure. Do you get the same warnings when visiting a website hosted on that platform?

If not, then it could well be the HTTP versus HTTPS thing.


Hi @bobpullen,

Yes I am external!

The ping failure is down to McAfee Net Guard blocking access because the address is classified as "bad" - it picked that up when I clicked a link (it was by accident on the forum pages so I do not recall which one).

Yes I can get to the graphic in the link.

Disabling Net Guard allows ping to work.

The residual question is why is this IP address black listed and who needs to do what to have it reviewed?

...can you also read my PM on a different and more serious issue please.

 

 

Community Gaffer
Community Gaffer
Posts: 12,861
Thanks: 677
Fixes: 64
Registered: 04-04-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee


townman wrote:

The residual question is why is this IP address black listed and who needs to do what to have it reviewed?

What element of McAfee is flagging the warning? Is that Netguard too?

...can you also read my PM on a different and more serious issue please.

I've a few PMs to get through, apologies for the delay Sad


Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

Superuser
Superuser
Posts: 10,023
Thanks: 1,562
Fixes: 19
Registered: 22-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

H Bob,

I presume it's net guard, for if I disable it, I can ping the IP address.  Clearly I do not want it switched off for them I'll have no protection against really rouge sites.

Kevin

Community Gaffer
Community Gaffer
Posts: 12,861
Thanks: 677
Fixes: 64
Registered: 04-04-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

Sorry, should have asked: is it the Plusnet Protect variant of McAfee you're running? Just trying to decide the best way to report the problem Wink

Also, I assume it's still happening?

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

Superuser
Superuser
Posts: 10,023
Thanks: 1,562
Fixes: 19
Registered: 22-08-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

Hi Bob,

No it's not the PlusNet variant, it's a standard commercial product.  Protect all IIRC (not near the PC) at present.  Is it still happening?  Well that depends what "it" is!

When I looked yesterday, Net Guard still has the IP address listed.  I cannot see a ready means of removing or refreshing the entry.  With NG off I can ping the address.  With NG on I cannot ping the address, yet I could access the graphic you referenced above.

Something does not make sense.  I'd suggest that the IP owner needs to identify why McAfee has the address black balled, then request reassessment.

Kevin

Community Gaffer
Community Gaffer
Posts: 12,861
Thanks: 677
Fixes: 64
Registered: 04-04-2007

Re: 212.159.9.91 - PlusNet home pages - blocked by McAfee

Thanks, found this. Odd that the second IP that points to Homepages comes up clean. I've submitted a delisting request here.

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵