Why is this user being blocked?

Posted: Sat Mar 12, 2011 11:20 am

I have a user from Austria who keeps getting the following:

Quote:

You have been blocked from entering this site.

You have attempted an unknown attack on this site.

All of the following information has been gathered to assist the webmaster should this need to be reported to local or federal law enforcement.

If you think this is a mistake you can contact the site webmaster at admin(at)xxxxxxx(dot)org.

Be SURE to include the following information in any email!
User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.14) Gecko/20110218 Firefox/3.6.14
Remote Address: 84.113.xxx.xxx
Client IP: none
Forwarded For: none
Date Blocked: 2011-03-12 @ 08:42:05 PST GMT -0800
Block expires: Permanent

He tells me that "by default i am using IE 8. Using Firefox I am banned as well, getting the text below. Why is my IP showing up as Remote Address? Shouldn't it be shown as Client IP instead?". His is a static IP address, so searching for him should not be difficult.

So far as I can tell, I can't find any problem in the logs or anywhere else.

Suggestions? Ideas?

registered · Posted: Sat Mar 12, 2011 11:39 am

Have you unblocked his IP from the nuke sentinel admin and htaccess? if so, does it automatically block him when he returns to your site?

Posted: Sat Mar 12, 2011 10:43 pm

What user name is he using? Just off the top I am guessing some kind of string blocker. Nuke and NS have a few double secret probation strings that can lead to the results you quoted.

Posted: Sun Mar 13, 2011 9:39 am

Thanks Nuken! You put me on the right track. worship

I had totally forgotten about the .htaccess, but that wasn't the problem. But the comment about "nuke sentinel admin" made me dig a lot deeper than I had been previously looking.

I am not sure why I had some blocked IP addresses set up with asterisks, but I did. In this case, it was "84.113.*.*" and I have now removed all the blocked addresses like this (there weren't many thank goodness) so I won't have this issue again. In any case, this trusted user is now able to access my site and that's what counts!

I guess it was because of the asterisks that when I did a IP Search the address I was looking for, nothing ever appeared. Something to be remembered in the event a incident like this ever comes up again. Wink