Re: [swinog] CDN: Access Denied Reference #18.cad1f557.1634833505.1903b12e

> Are you sure Amazon is responsible? I mainly see Akamai as a CDN here. But > maybe it's different, depending on the source IP address... Aeh! s/Amazon/Akamai/ sorry! > For Akamai, this may be of interest: > https://www.akamai.com/us/en/clientrep-lookup/ I stumbled over this page, but

Re: [swinog] CDN: Access Denied Reference #18.cad1f557.1634833505.1903b12e

> I opened a case with Amazon Are you sure Amazon is responsible? I mainly see Akamai as a CDN here. But maybe it's different, depending on the source IP address... > $ dig +short www.klm.com > www.klm.com.edgekey.net. > e40771.a.akamaiedge.net. > 80.67.82.17 > 80.67.82.16 > > $ dig +short

Re: [swinog] CDN: Access Denied Reference #18.cad1f557.1634833505.1903b12e

Hi, Did you check if the customer's network is maybe infected with some botnet or spambot that triggers honeypots? Clearly, if the IP changes and the customer gets blocked again, it is something being caused by the source IP... Netflow... Netflow all the things ;) Greets, Jeroen -- > On

Re: [swinog] CDN: Access Denied Reference #18.cad1f557.1634833505.1903b12e

Hi Jeroen > Did you check if the customer's network is maybe infected with some botnet or > spambot that triggers honeypots? Usually we learn about such incidents through GovCert or other complaints. We received none. > Clearly, if the IP changes and the customer gets blocked again, it is >

[swinog] CDN: Access Denied Reference #18.cad1f557.1634833505.1903b12e

Dear Colleagues We have a customer whose IP keep getting blocked by various CDN operators. If we change his IP, this solved the issue for a couple of days, then he is blocked again. Actual IP: 87.102.212.133 At the moment, this IP is being blocked by the CDN used by: klm.com nespresso.com