Why are USPS, the Washington Post, Oracle, and MailChimp blocking our home network from accessing their sites?

Question

The problem seems to be that our home network is being blocked from high-profile sites that have really good security measures in place. For example, when I go to the Washington Post's website I get this ambiguous message:

Access Denied

You don't have permission to access "http://www.washingtonpost.com/" on this server.

Reference #18.7962317.1542307718.51d6f537

I experience similar behaviors when I also visit USPS.com, any email links originating from MailChimp servers, and most recently we've discovered that Oracle.com give us this equally ambiguous message:

This site http://www.oracle.com/ is experiencing technical difficulty. We are aware of the issue and are working as quick as possible to correct the issue.

We apologize for any inconvenience this may have caused.

To speak with an Oracle sales representative: 1.800.ORACLE1.

To contact Oracle Corporate Headquarters from anywhere in the world: >1.650.506.7000.

To get technical support in the United States: 1.800.633.0738.

Incident Number: 18.4c962317.1542307950.e2847c1

---

So the legwork that I've done so far in trying to trouble shoot this is as follows:

On my NetGear Router, there is an option to change the default MAC address for the router to copy/use my computer's MAC address. When I apply this change to the router, everything opens back up for about a day, and then by the next day the blockage has returned. When I revert back to the router's default MAC address, the issue remains.

I'm suspecting that this may have something to do with the family computer that is connected via Ethernet -- that there might be a virus or something else that is compromising the integrity of the network for everyone, but I cannot tell for sure.

When I do an IP Address blacklist check, the only negative result is from http://dnsbl.spfbl.net/en/45.59.88.92, which this is our IP address by the way. I don't think this is an IP address issue, but I'm really confused by what's going on. I'm not sure what to do for next step, as most Google searches derail me into a different direction.

Oh, I have another son who's using a VPN and he says that he is experiencing the same behavior on his computer as well.

My phone has the same issues when connecting through the local network. However when I switch my phone to connect via data, using the cell towers, the issue goes away. So it seems pretty obvious that somehow our local network has been blacklisted, but how do I assess this and find a cause/fix?

I've got a NetGear R6250 router. I'm web developer, but not much of a network guy. Thanks for your help!

Answer 1

All of these sites are behind the Akamai CDN. The message and code indicates that your cite was blocked by Akamai. As for why Akamai might have done this see Why is Akamai blocking me?. Notably it might block an IP address if this IP was the source of potential malicious activity, like attempts to attack sites protected by Akamai (SQL injection, ...), web scraping, vulnerability scanning etc.

I recommend to check if any of such activity might have been purposefully originated from your network or if there is some infected system which (for example as part of a botnet) was misused by an outside attacker for such activity.

Akamai also provides a tool to check your IP address: Client Reputation Overview. Maybe you can get more information about the cause of blocking there.

When I apply this change to the router, everything opens back up for about a day, and then by the next day the blockage has returned. When I revert back to the router's default MAC address, the issue remains.

Given that the MAC address of your router visible to your ISP my only explanation for this behavior is that you automatically get assigned a new external IP address when the MAC changes. Given that this only works for a limited time it is likely that the issue causing the blocking is an ongoing problem in your network.

Answer 2

Apparently your ISP is not providing a PTR record for your address in their DNS. These sites apparently desire that information. You might want to complain to your ISP. The PTR record does not have to point to something sexy or memorable, just a valid matching A record.