Support article
The server blocked my IP. Why?
Sometimes a user can't access from their home, office, or a specific location, but can access from other places.
Sometimes a user cannot access from their home, office, or any other specific location, but can access from other places.
In these situations, the most likely cause is that our servers’ firewall has blocked your IP.
WHY IS AN IP BLOCKED?
Basically, to protect the server and the websites hosted on that machine. An IP is blocked when it is considered a threat.
WHY HAS MY IP BEEN CONSIDERED A THREAT?
In most cases, it’s due to repeated failed connections to one of the services. For example, errors when logging into FTP, email, or cPanel.
Here is an example of a user who was blocked:
Time: Fri May 16 23:30:14 2014 +0200 IP: 186.3.208.100 (EC/Ecuador/-) Failures: 7 (smtpauth) Interval: 86400 seconds Blocked: Temporary Block (IP match in csf.allow, block may not work)
Log entries:
2014-05-16 22:45:05 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:34473: 535 Incorrect authentication data (set_id=info@xxxxx) May 16 22:45:12 us30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=186.3.208.100, lip=69.64.48.59, TLS, session= 2014-05-16 23:00:05 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:56948: 535 Incorrect authentication data (set_id=info@xxxx) May 16 23:00:12 us30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=186.3.208.100, lip=69.64.48.59, TLS, session= 2014-05-16 23:15:05 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:39386: 535 Incorrect authentication data (set_id=info@xxxxx) May 16 23:15:12 us30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=186.3.208.100, lip=69.64.48.59, TLS, session= 2014-05-16 23:30:04 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:57003: 535 Incorrect authentication data (set_id=info@xxxx)
As you can see, this user repeatedly tried to access the imap service with the wrong password. The server considers it a threat and blocks it, protecting the domain owner who is receiving the brute-force attack.
WHAT CAN I DO IN THIS CASE?
Blocks are usually released every 10 minutes. So there are two things you should do:
- Fix the problem that caused the block.
- Wait for the block to be released.
WHAT IF I DON’T KNOW THE REASON FOR THE PROBLEM?
In that case, send us your IP number, and we’ll send you the report and an explanation of why your IP was blocked.
HOW DO I KNOW WHAT MY IP IS?
You can see your IP by visiting: mihosting.com/ip
WHAT IF I NEED TO RESTORE MY ACCESS URGENTLY?
In that case, contact us — either by chat or by phone — and one of our technicians will remove your IP from the blocked IPs in the firewall.
Important Note: We can only assist requests from clients who have their hosting service on our servers.