DNS cache and site unreachable

[filipecsilva]

Hi,

I've got reports from users who can't access my website. The users have also reported from other UK ISPs, but the problem is only occurring inside UK. It seems that the users DNS are not being updated and only a cached IP is being delivered.

The problem started earlier this year when the site got hacked and then blacklisted, but it has already been two months since it was cleaned and firewalled. And with the firewall came an IP change which has never reached UK customers.

The domain is beautybosshq.com and I have some dig tests:

C:\Users\timdu>nslookup beautybosshq.com
Server: bthub
Address: 192.168.1.254

Non-authoritative answer:
Name: beautybosshq.com
Address: 81.130.111.239

C:\Users\timdu>nslookup beautybosshq.com 8.8.8.8
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: beautybosshq.com
Address: 192.124.249.7

The technical team from other ISPs has already reached me to check the problem. Is it possible to get in contact with the network team from BT?

Thanks!

BR
Filipe Silva

[-Richie-]

Is 192.124.249.7 the right address ? that's where mine resolves using BT broadband.

C:\Users\Richie>nslookup beautybosshq.com
Server:  bthub
Address:  192.168.1.254

Non-authoritative answer:
Name:    beautybosshq.com
Address:  192.124.249.7

[Les-Gibson]

@filipecsilva @-Richie- 

Whoever hosts the website at aforementioned IP address, you may or may not be aware of the below, I thought I'd post it to alert you in case you're not.

[filipecsilva]

Yes! Thank you for your feedback.
The old IP is 81.130.111.239 and the 192.124.249.7 is the firewalled one.
Still, the problem persist for some users, can they be receiving a cache response? Does BT uses cache servers?

[Les-Gibson]

When I mouse over the link you posted, it says it's an https site but when I tested it, Ubuntu tells me there's no certificate

[filipecsilva]

It has a valid certificate. I only get cert error when it redirects to incorrect address. Do you know a way to check the certificate that is said to be invalid?

[Les-Gibson]

I clicked on the link that you posted and I've not used that site before so I wasn't working on cached data.

I didn't check the IP it sent me to but there was absolutely no sign of a certificate at all (no padlock, or crossed out padlock nothing) so I'm thinking perhaps you have a configuration problem, maybe caused by the hackers.

Edit: As I said earlier, this was on Ubuntu (I wouldn't risk going onto a blacklisted site with a windows machine), but I can't see that making that big a difference

[filipecsilva]

@Les-Gibson
But the site is not blacklisted, and that is the problem! The reputation has been cleaned for quite some time now, but for some providers inside UK is said to be unreachable.
Can you run a nslookup or dig test and post the results? I want to know why some users can access it and others not.
And thank you for your time and attention! It's much appreciated!
Can you

[-Richie-]

I don't have any issues with your site, it loads and no warnings.

If you have contact with anyone having issues, see if they have web protection and parental controls enabaled, they'll be listed logging into MyBT

[Les-Gibson]

@filipecsilva 

Sorry, I've only just seen your last post.

I've also seen the post from @-Richie- and I can confirm that, having now disabled Web Protect, I can now see your site.

The one observation I would make is that it uses Flash, which is now considered to be a security flaw and will soon not be supported by several common browsers.