I began noticing some strange behavior - 401 errors on status/update calls saying "We were unable to authenticate you".
I racked my brain, checked and rechecked the username and password, then finally I decided to create a small script to check my ratelimit at account/rate_limit_status.xml and sure enough, I was at 0. I waited an hour, and I was at 54. Within minutes, however, I was back to 0. So, naturally I thought some bot had hijacked my scripts and was eating up my api calls. I downloaded server logs. There is no excessive activity at all. In any case, all my calls are authenticated, so they should be using the users api limit, not my servers. On a hunch, I uploaded the same rate limit checking script to a different host that I have access to (with a different IP). Guess what? 100 hits remaining. In fact, whether I authenticate the request or not, I'm still at 0 hits remaining whenever I try that same script on my server. But, if I try it somewhere else, I have all 100. Am I blacklisted?
