212.159.9.91 - PlusNet home pages - blocked by McAfee

[#1]

Why when I first logged into this new service has McAfee thrown a hissing fit and declared 212.159.9.91 a dangerous place to go?

This site is a dangerous place...

C:\Users\Kevin>ping -a 212.159.9.91

Pinging homepages.plus.net [212.159.9.91] with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.

[#2]

Add this one - 62.161.94.230 - too whilst connecting to the forum...

#09/04/2016-20:38:52.79
C:\Users\Kevin>ping -a 62.161.94.230

Pinging logs1229.xiti.com [62.161.94.230] with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.

[#3]

Not sure about that 2nd one, you'll have to investigate a bit more to find out what's there. But I guess similar to the first one, it's related to the Plusnet Navbar (and possiibly it's links) and stuff that's being delivered as insecure content (http) whilst the forum is https.

[#4]

I think this is more than a http vs. https issue.  The PlusNet IP address is designated as dangerous by McAfee - as things stand, pings to this address fail - will review this after a restart at some future point.

[#5]

The Homepages IPs respond to pings from here (external DSL circuit and internal network):

C:\Users\mail>ping 212.159.9.91

Pinging 212.159.9.91 with 32 bytes of data:
Reply from 212.159.9.91: bytes=32 time=20ms TTL=51
Reply from 212.159.9.91: bytes=32 time=18ms TTL=51
Reply from 212.159.9.91: bytes=32 time=18ms TTL=51
Reply from 212.159.9.91: bytes=32 time=19ms TTL=51

Ping statistics for 212.159.9.91:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 18ms, Maximum = 20ms, Average = 18ms

Are you trying from an external connection? The servers have recently been moved behind new load balancers and they may be denying outside ICMP requests.

As to why the servers are seen as malicious, I'm not sure. Do you get the same warnings when visiting a website hosted on that platform?

If not, then it could well be the HTTP versus HTTPS thing.

[#6]

I don't know, so I'll ask, could you test the ICMP responses using a VPN?

[#7]

---

@bobpullen wrote:

Are you trying from an external connection? The servers have recently been moved behind new load balancers and they may be denying outside ICMP requests.

As to why the servers are seen as malicious, I'm not sure. Do you get the same warnings when visiting a website hosted on that platform?

If not, then it could well be the HTTP versus HTTPS thing.

---

Hi @bobpullen,

Yes I am external!

The ping failure is down to McAfee Net Guard blocking access because the address is classified as "bad" - it picked that up when I clicked a link (it was by accident on the forum pages so I do not recall which one).

Yes I can get to the graphic in the link.

Disabling Net Guard allows ping to work.

The residual question is why is this IP address black listed and who needs to do what to have it reviewed?

...can you also read my PM on a different and more serious issue please.

[#8]

---

@Townman wrote:

The residual question is why is this IP address black listed and who needs to do what to have it reviewed?

What element of McAfee is flagging the warning? Is that Netguard too?

...can you also read my PM on a different and more serious issue please.

I've a few PMs to get through, apologies for the delay

---

[#9]

H Bob,

I presume it's net guard, for if I disable it, I can ping the IP address.  Clearly I do not want it switched off for them I'll have no protection against really rouge sites.

Kevin

[#10]

Sorry, should have asked: is it the Plusnet Protect variant of McAfee you're running? Just trying to decide the best way to report the problem

Also, I assume it's still happening?

[#11]

Hi Bob,

No it's not the PlusNet variant, it's a standard commercial product.  Protect all IIRC (not near the PC) at present.  Is it still happening?  Well that depends what "it" is!

When I looked yesterday, Net Guard still has the IP address listed.  I cannot see a ready means of removing or refreshing the entry.  With NG off I can ping the address.  With NG on I cannot ping the address, yet I could access the graphic you referenced above.

Something does not make sense.  I'd suggest that the IP owner needs to identify why McAfee has the address black balled, then request reassessment.

Kevin

[#12]

Thanks, found this. Odd that the second IP that points to Homepages comes up clean. I've submitted a delisting request here.