2

So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few examples:

Southwest.com: "Access Denied" You don't have permission to access "http://www.southwest.com/" on this server.

Google search: While in incognito I sometimes see "Unusual traffic from your computer network" and am presented with a captcha. This doesn't happen when I'm not in incognito, likely because I'm logged into one of my google accounts.

Yelp: I am sometimes presented with a captcha when viewing a business page (especially coming from a search engine).

Playstation Vue login: Same "Access Denied" response as southwest.com every now and then.

Schwab.com: I have been locked out of the entire site 3 times over the course of a few months. I just get a white screen. Called tech support and they said my IP was banned, that they would unban it, but couldn't give me a reason why.

Godaddy: I tried logging into my account once with the correct password and received a message saying I was locked out for 5 hours.

All of these happen from multiple devices and operating systems (and only when I'm connected to my home network), so clearly there's something weird going on with my network traffic. I just don't know how to track it down. I am somewhat familiar with Wireshark and have poked around with the filters and stats trying to pinpoint sketchy traffic but I haven't been able to find anything yet. It definitely seems like our network is either being used as a VPN/open proxy or one of us has malware.

I live with a roommate who I've talked to and he's adamant that he's not running anything sketchy and says he just recently ran virus/malware scans on his two devices. I personally have a desktop and laptop. Both have come back clean from all the virus/malware scans I've run and I'm generally pretty safe with software and browsing habits. Just to be extra safe I reformatted both machines this week. I also checked my router against VPNFilter using this URL: http://www.symantec.com/filtercheck/ and it came back clean, but I'm not certain that the router is actually clean. I recognize all devices that are connected to my router, and I recently configured the router to use Google's DNS. My next step is to reset the router back to factory settings in case that somehow got infected with anything else.

I have no clue what steps to take next. What's the best way to detect what's going on? Can I use Wireshark filters to isolate any potential traffic that's using our network as a VPN/proxy/tor exit node? Can I somehow filter for domain names or the IPs of the sites that I'm blocked from and try to capture any automated requests going to them?

  • 2
    Since this happens for multiple devices and only in your home network I think you are right by being suspicious of the router. Routers are often insecure and also common targets of attacks. Trying to make a hard reset of the router as you've suggested would be a good next step. If this does not help maybe replace the router. Note that it might not help immediately since your IP address is probably on some blacklists already and it will takes some time to get clean. You might check here if your IP address is on some common blacklists. – Steffen Ullrich Nov 9 '18 at 18:36
  • Do you have a modem/router combo device, OR do you also have an additional cable modem? – Daisetsu Nov 9 '18 at 18:42
  • @SteffenUllrich I have run that check, and my IP appears on 4 of those blacklists. Given the nature of the situation I completely understand that anything I change in my setup will not help immediately, which is really what makes diagnosing the issue so difficult. – Jeff Nov 9 '18 at 18:47
  • 1
    @Jeff I was thinking you may have had a combo modem, but that doesn't seem to be the case. I would focus on your router. Failing that, do a network scan and see what's actually runnning on your network. Do you have old unpached security cameras? A neighbor using your WiFi? Etc. A scan (try nmap) will tell you what's visible on your network. – Daisetsu Nov 9 '18 at 18:58
  • 2
    You might also check the firmware of your devices and compare this with what the vendor offers. It looks like the router had some serious vulnerabilities at least in 2013 and the modem had issues in 2016. – Steffen Ullrich Nov 9 '18 at 19:22
0

Each taken on their own, each of these things listed may not be too much to be concerned about. Taken together, it's hard to say.

Southwest.com: I also get a Access Denied at http://www.southwest.com/ (and at https://www.southwest.com/). Their server is misconfigured. Nothing to worry about. Edit: Upon a closer investigation, the http://www.southwest.com/ page loads fine for me when I'm using an IP address in the USA, and gives me an Access Denied with an IP from anywhere in the world (that I've tried — several through Europe, India, Australia). So I'm not honestly sure about his one. They may filter IPs pretty aggressively, and it may be a similar situation to the Schwab.com issue you experienced (and if you've discovered your IP has been blacklisted, that may not be surprising).

Google search: I also get occasional CAPTCHAs when in incognito mode, though this might indicate genuine unusual traffic.

Yelp, Playstation Vue: I'm not a user of these sites and can't offer comment, but your description of these intermittent issues doesn't seem too unusual.

Schwab.com: This could indicate a genuine issue. If I can assume that you are using a normal home internet connection, then with most internet providers your IP address actually changes fairly often. This may mean that you were simply automatically assigned an IP that someone else has used to attack the Schwab website, either intentionally or (more likely) as an unwitting part of a botnet. If you have a dynamic IP (your IP changes regularly), I wouldn't be too concerned about this. If, however, you have a static IP (your IP is always the same), this is a concern, as it means it's something on your home network that's somehow become an unwitting part of a bot-net. Your IPS can tell you which (dynamic or static IP) you have, and may be able to switch you from one to the other if you like.

Godaddy: This is much more likely to indicate that someone is attempting to brute-force your Godaddy password than that there's an infection on your home computer/network/router. This is not that unusual, but there are some important steps to protect your accounts. Firstly, Godaddy supports two factor authentication, which you should enable immediately if you haven't (security professionals recommend enabling 2FA wherever it's supported). Secondly, you should register your email addresses with https://haveibeenpwned.com/, since if your login at a place like Godaddy is being attacked, there's an excellent chance that your credentials have been leaked somewhere, and it's very important to know what's happening with your data.

In short, I don't think you have much reason to worry at this point. Each of those symptoms has a separate, reasonable explanation. You've also taken some good steps so far. However, there are some further steps you can take to protect yourself.

  1. haveibeenpwned.com, as mentioned above.
  2. Always ensure your software (operating system, antivirus, etc) is fully up to date.
  3. If you have any "smart" or "Internet-of-Things" devices (smart lightbulbs, app-enabled dishwashers, security cameras, what have you) be sure that they are also completely updated with their current firmware and software (people often forget these). If they don't need an external connection to the internet for their functionality, then consider blocking them from accessing the internet too. (Sadly, most of these devices need full internet connectivity to work, but still.)
  4. Resetting your router to factory settings won't hurt, and is worth doing. You should also make sure, like with everything else, that the router software is fully up to date. I note in the comments you have separate modem and router; rinse and repeat for the modem.
  5. If you want, you can start looking at your network like an attacker would. Tools like nmap can be used to find things on your network that may not appear (for whatever reason) in your router's interface. Wireshark can be used to investigate traffic, but if you're not able to run it directly on your router, it can take some effort to set up a system whereby your Wireshark can see all the traffic going in and out.

Hope this helps!

  • "Southwest.com" - I don't get Access Denied there. How do you come to the conclusion that the server is misconfigured? – Steffen Ullrich Nov 9 '18 at 19:11
  • @SteffenUllrich, I've just tried again: Access Denied You don't have permission to access "http://www.southwest.com/" on this server. Reference #18.643c1002.1541790879.238d6cef However... interestingly enough, when I switch to a VPN end-point in the US, the page loads without issue, and any IP from outside the USA I get "Access Denied". Will revise my answer. – Johnny Nov 9 '18 at 19:20
  • I have no problem to access the site from Germany, – Steffen Ullrich Nov 9 '18 at 19:24
  • @SteffenUllrich Perhaps the VPN I use has been blacklisted there as well. – Johnny Nov 9 '18 at 19:27
  • I appreciate the detailed response, but there are some flaws. I can tell you with 99% certainty that these are all related. 2nd, it sounds like you're experiencing the same problems from these sites that I am when you're connected to a VPN. This also lends credence to my suspicion that my network is being used for VPN/proxy traffic. Third, according to my ISP I have a dynamic IP, but I'm certain that I've had the same IP for 2 years. And lastly regarding Godaddy, this is not account-specific. I can successfully log into my account from another IP. I'm blocked from any account on my home IP – Jeff Nov 9 '18 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.