Website flagged as Hate Speech incorrectly on Safeguard

[#1]

@James30 

---

@James30 wrote:

Here's the DNS address we give to the router depending on weather it's on or off  - About DNS server and website settings | Help | Plusnet

You might want to get that help page about DNS settings updated, as the Plusnet DNS addresses were recently updated -

https://community.plus.net/t5/Tech-Help-Software-Hardware-etc/Has-Plusnet-server-212-159-6-9-just-go... 

I also wonder whether this recent change to the DNS platform is related to @marcKV 's problem ?

---

@marcKV wrote:

Primary DNS: 212.159.13.52
Secondary DNS: 212.159.13.51

Should I change them to the ones on the link you sent?

---

The DNSs you listed are the latest addresses that you are intended to use going forward,  however it would be interesting to see whether using the previous DNS addresses (from that link) makes any difference to your issue, to see whether the new DNS platform behaves differently in being more sensitive to detecting 'hate speech' ?

[#2]

It does not appear that SafeGuard is blocking your address to me.

I have SafeGuard on anyway, including "Hate & Intolerance - Blocked" and your site works fine for me on my PlusNet connection.

SafeGuard is DNS based, and should be handing you DNS servers:
nameserver 213.120.234.42
nameserver 213.120.234.38

asking either of those servers for your website address responds correctly.

>nslookup marckeeling.co.uk. 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: marckeeling.co.uk
Address: 160.153.138.203

same as asking Google Public DNS

>nslookup marckeeling.co.uk. 8.8.8.8
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: marckeeling.co.uk
Address: 160.153.138.203

whereas, asking for a blocked site gives a dummy BT IP address (so it can intercept and say its blocked)

>nslookup sex.com. 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: sex.com
Address: 81.130.111.239

and

>nslookup porn.com. 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: porn.com
Address: 81.130.111.239

Note the answer is the same for the blocked sites

So using SafeGuard on my plusnet connection, your site looks fine. I wonder if the turning on/off of SafeGuard and restarting your connection is giving you different IP addresses each time, and its one of these that is actually blocked by your host for example?

[#3]

@James30 

Thanks, I actually don't know how to change the DNS settings on the hub one. Or am I supposed to do this at a device level?

@seebee Thanks for looking. Yeah I don't actually think it is safeguard blocking it on purpose now, but it is still related to it in some way, as pointed out before the only way to fix it on my network is to disable that category.

---

So using SafeGuard on my plusnet connection, your site looks fine. I wonder if the turning on/off of SafeGuard and restarting your connection is giving you different IP addresses each time, and its one of these that is actually blocked by your host for example?

---

Potentially. However I don't actually have safeguard enabled. Only the category needs to be blocked for the site to stop loading. It is good to hear others arent being blocked though.

[#4]

The error in post 9 is a time out, which is weird.

If it were SafeGuard you typically get 2 results - if you go to a blocked "http" site you get redirected quickly to a "https://blocked.plus.net/index/..." site clearly explaining that it is blocked - if you go to a blocked "https" site you get an error like ERR_SSL_VERSION_OR_CIPHER_MISMATCH as the interception means the host is not expected.

Do you always get the timeout error? What if you try some of the nslookup commands, what do you see?

[#5]

@seebee 

Yes I always get the timeout error.
I am actually struggling to turn off those categories now. They keep defaulting to be back on.

Default Server: dsldevice.lan
Address: 192.168.1.254

> www.marckeeling.co.uk
Server: dsldevice.lan
Address: 192.168.1.254

Non-authoritative answer:
Name: marckeeling.co.uk
Address: 160.153.138.203
Aliases: www.marckeeling.co.uk

I get this from using nslookup, is that what you mean?

[#6]

Yes, that means you asked your local router (192.168.1.254) for the address of the website and it gave you the correct answer (160.153.138.203). As you are getting correct DNS answers I can't see how SafeGaurd is involved!

[#7]

@seebee 
Well I'm out of ideas then. All I know for sure is that on my plusnet network, I can't connect to that site reliably. Any other connection is fine. Even changing safeguard options doesnt appear to be working now.

[#8]

@James30 @seebee 

I have noticed I can't access proxy websites either, which I wanted to try to see if I could reach my website through a proxy.

Websites like hidemyass and megaproxy just return this error

This site can’t provide a secure connectionwww.megaproxy.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Unsupported protocol

The client and server don't support a common SSL protocol version or cipher suite.

[#9]

@marcKV - Do you know how to change the DNS address in the PC, within the WIFI/Ethernet settings or have you already changed it? Id suggest changing it on the device a as test to googles 8.8.8.8 and report back. Cheers

[#10]

@marcKV - Also make sure safeguard is turned off on the account and router is reboot the router first before manually updating the computers DNS address.

[#11]

@James30 
Heya, I tried those suggestions, and it did not help.

[#12]

@James30
Is there anything else that might work. Forcing IP change for example.
Works from VPN so cant help wondering.

[#13]

I think there's potentially more than one thing happening here.

The inability to access your personal site seems that it maybe due to routing, or the remote server/Go Daddy somehow refusing connection attempts. As a starter for ten, what happens if you try tracing to the site from a command line.

I can reach the site, and I see this...

>tracert marckeeling.co.uk

Tracing route to marckeeling.co.uk [160.153.138.203]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  home.gateway [192.168.1.254]
  2     7 ms     7 ms     6 ms  254.core.plus.net [195.166.130.254]
  3     8 ms     7 ms     7 ms  84.93.253.115
  4     8 ms     7 ms     8 ms  core1-BE1.southbank.ukcore.bt.net [195.99.125.130]
  5     7 ms     8 ms    10 ms  core5-hu0-3-0-26.faraday.ukcore.bt.net [109.159.252.140]
  6     7 ms     7 ms     8 ms  166-49-209-132.gia.bt.net [166.49.209.132]
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9    13 ms    14 ms    14 ms  adm-bb4-link.ip.twelve99.net [62.115.140.43]
 10    13 ms    13 ms    15 ms  adm-b10-link.ip.twelve99.net [62.115.120.229]
 11    14 ms    13 ms    14 ms  ae15.ibrsa0105-01.ams3.bb.godaddy.com [62.115.184.19]
 12     *        *        *     Request timed out.
 13    14 ms    14 ms    14 ms  ae2.ams3-pesa0106-01.bb.gdinf.net [188.121.32.5]
 14    14 ms    14 ms    14 ms  188.121.32.115
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19    13 ms    13 ms    13 ms  203.138.153.160.host.secureserver.net [160.153.138.203]

The IP address you're assigned could well be influencing things here. It's from an ex-ARIN range, so there could be some odd geo-location happening somewhere. It hasn't changed for almost a week so there might be some merit in us forcing this as a diagnostic step.

The inability to access proxy sites it's an intended consequence of enabling Safeguard. If our website says the service is disabled, yet you get SSL errors trying to get to proxy sites, then my money woujld be on some sort of back-end misalignment. Might be worth enabling Safeguard, rebooting your router, leaving overnight, disabling Safeguard and rebooting again in the morning (essentially a 'switch it on/switch it back off).

[#14]

Hmm, has SafeGuard stopped working for anyone else?

I was just double checking my nslookup commands from above and the SafeGuard DNS server for example is allowing a blocked category

>nslookup porn.com. 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: porn.com
Addresses: 185.88.180.183
185.88.180.167

It isn't replying with the BT address for interception, like above.

I hadn't changed any settings in my account, but I since double checked and SafeGuard is still enabled, and I rebooted my router anyway, but no difference. Has some overnight maintenance overran for example?

[#15]

Just noticed it is now working again!

>nslookup porn.com. 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: porn.com
Address: 81.130.111.239