hallux Posted May 4, 2021 #1 Share Posted May 4, 2021 Over the last couple days when I load forum pages and/or posts I'm getting a notification from my router that it's blocked access from/to an IP address for security reasons. Obviously, I'm not certain what element is causing this as my router is blocking it from loading. This is the only page or forum triggering this alert, in all the sub-forums of this site that I visit. The IP that is triggering this alert is 76.76.21.21 Link to comment Share on other sites More sharing options...
Rare Host Kat Posted May 4, 2021 #2 Share Posted May 4, 2021 5 minutes ago, hallux said: Over the last couple days when I load forum pages and/or posts I'm getting a notification from my router that it's blocked access from/to an IP address for security reasons. Obviously, I'm not certain what element is causing this as my router is blocking it from loading. This is the only page or forum triggering this alert, in all the sub-forums of this site that I visit. The IP that is triggering this alert is 76.76.21.21 Send an email to help@cuisecritic.com from your Cruise Critic email address of record. Mention your user name as well as other important details such as your browser, device, etc. Hope you are able to find the answers you seek! 🍀 Link to comment Share on other sites More sharing options...
hallux Posted May 4, 2021 Author #3 Share Posted May 4, 2021 5 minutes ago, Host Kat said: Hope you are able to find the answers you seek! Thanks. I'm not so much worried about myself, with my router blocking the suspect traffic already anyway, but those who are not as technologically-advanced or protected as I am. Link to comment Share on other sites More sharing options...
Rare Host Kat Posted May 4, 2021 #4 Share Posted May 4, 2021 You are most welcome! And you might want to include screenshots & if you use a content blocker too. Link to comment Share on other sites More sharing options...
Administrators Rare LauraS Posted May 4, 2021 Administrators #5 Share Posted May 4, 2021 We're on this. Just an FYI that IP does appear to be associated with us, so there isn't anything to worry about. Link to comment Share on other sites More sharing options...
hallux Posted May 4, 2021 Author #6 Share Posted May 4, 2021 @Host KatI included a screenshot of the notifications on my router. Yes, I use an ad blocker, but that's not what's giving me the notifications, it's being blocked before it gets there... Link to comment Share on other sites More sharing options...
Administrators Rare LauraS Posted May 4, 2021 Administrators #7 Share Posted May 4, 2021 @hallux where is the screenshot? I'm not seeing it Link to comment Share on other sites More sharing options...
hallux Posted May 4, 2021 Author #8 Share Posted May 4, 2021 @LauraSI attached it to the email I was advised by Kat to send. I'll add it here. It doesn't say much except that traffic was blocked for security reasons... Link to comment Share on other sites More sharing options...
Administrators Rare LauraS Posted May 4, 2021 Administrators #9 Share Posted May 4, 2021 Thanks @halluck this is very helpful. Link to comment Share on other sites More sharing options...
hallux Posted May 4, 2021 Author #10 Share Posted May 4, 2021 (edited) If it helps - the router is a Synology RT2600ac, this is a feature built into the unit, or available as an add-on package from Synology to enhance the functionality of the router. It's possible there's nothing nefarious going on, but it only recently started (meaning something changed) and I've had the router a little over a year... Edited May 4, 2021 by hallux Link to comment Share on other sites More sharing options...
NTXCruiser8 Posted May 4, 2021 #11 Share Posted May 4, 2021 Howdy, TIL Synology makes routers. That IP has over 10,000 domains on it according to urlscan, abuseipdb shows 100% confidence of abuse, and further - that IP is getting scrutinized right now because of an article that came out today. Motherboard/Vice put out a story how a well funded startup was offering people $500 to share their workplace login credentials through a thing called Workplace Unite. Really crazy story but looking at some of the domains related to the phishing thing I can see they were hosted on that IP. So many sites are on that IP... apparently a company called Vercel has that /24 block and hosts it on Amazon AWS. So anyway, there's a chance something on the site you're pulling up (is it this one?) is hosted on that IP but not related to that story. The reason it's triggering over the last couple of days is because the IP has been flagged as dirty by whatever provider Synology pays for their threat intel feeds. It's only listed on one vendor in VirusTotal. Link to comment Share on other sites More sharing options...
hallux Posted May 5, 2021 Author #12 Share Posted May 5, 2021 23 minutes ago, NTXCruiser8 said: Howdy, TIL Synology makes routers. Yup, and I've been VERY happy with mine Thanks for the deeper dive on it, it may well not be something CC is doing directly then, maybe it's coming through an ad provider (which my browser is blocking through an ad blocker)? 24 minutes ago, NTXCruiser8 said: the site you're pulling up (is it this one?) Yes it is... Link to comment Share on other sites More sharing options...
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now