Login Denied Country is Blacklisted?

[PatrickVeenstra]

I was unable to access my own server because of "-ERR [AUTH] LOGIN DENIED -- COUNTRY IS BLACKLISTED" (that's what my email received, putty / WHM just deny access).

I suppose that's because I'm using the new feature that sets a list of countries to deny instead of using my own list of IPs. Somewhy it thinks that my IP is from one of those countries and doesn't allow me to access. That's a serious bug.
My IP was - Removed - as it's dynamic I've just restarted my router to "fix" it, but if something like that happens to a client that's a bigger problem. Besides that, can you please let me know what country that IP is supposed to be? And even better, please correct that:
- Removed -

 

[keat63]

I've also raised something similar.
We concluded that the issue is not related to Cpanel, but is by whoever maintains the country listing for I.P's

To my knowledge, Cpanel utilises a third party list, which unfortunately can contain errors.
There are 4,294,967,296 possible combinations of IP4.
No wonder then that there may be a few errors.

 

[rpvw]

I often use IP Location Finder - Geolocation as it searches 4 Geolocation Databases at once.

 

[cPanelMichael]

Hello @PatrickVeenstra,

The link in the previous post should help you to determine which country your IP address is associated with. Can you let us know which one it shows?

Thank you.

 

[PatrickVeenstra]

I can't, because a moderator has edited my first message that had the IP, and (obviously) I don't remember that IP.

There was no reason to remove the IP as it is dynamic and I changed it to access the server (even though I managed to access it from my phone as well). My dynamic IP isn't "private information" nor was it a security risk having it published over here. If you have a register of edits please republish it (or restore my message before the edit).

 

[Infopro]

Don't you hate that? Here is the IP from your original post:
47.61.136.65

 

[PatrickVeenstra]

IP Location Finder is more or less correct. That is, all show the correct country, but the the exact location (Region, City) is wrong except with EurekAPI that one does show the correct details.
Anyway the important thing is the country and all four DB are right about that one, so CPanel isn't using one of those DB to block that IP when blacklisting countries.

 

[cPanelMichael]

Hello @PatrickVeenstra,

Information about the GeoIP database utilized with cPHulk is found at the top the following file:

/usr/local/cpanel/3rdparty/share/geoipfree/IpToCountry.dat

Here are some links you can use to check which country cPHulk will detect for an IP address, and FAQ about the database:

GEO IP Database FAQ
IP to Country Database (IPV4 and IPV6)

I'm seeing United States for the IP address you provided. While I understand that isn't correct, can you first confirm if United States is a blocked country in your cPHulk configuration?

Thank you.

 

[PatrickVeenstra]

Yes it is.

 

[cPanelMichael]

Hello @PatrickVeenstra,

Here's a quote from GEO IP Database FAQ that explains how this can happen:

Q. I looked up my IP and it said it was from one country but I am somewhere else. What gives?

We use the registry assignments provided by the registrars. However discrepancies creep in especially in cases of large multinational companies who have their base of operation on one country and satellite offices in other countries. Typically what happens is that a company based in say, the United States, also has a branch in Africa or Asia.

In many cases, when the company is assigned a new block of IP addresses these will reflect the correct country (Africa or Asia for example). However, sometimes the location of the parent company is used - USA for example. This leads to an anomaly, where looking up the IP you know to be in one country appears to be somewhere else.

This is especially true of companies like AOL, Verizon, Sprint, Telefonica and others who do not operate only in one country. We have found IPs for both AOL and Verizon for example which are outside the US but show as originating in the US which is obviously not correct.

Although this only represents a tiny fraction of a percent, this is something that should be kept in mind.

Thank you.

 

[PatrickVeenstra]

Understood, thanks.

 

[Bernardohm]

I have a partner in China who was using foxmail without a problem. Just recently he is getting the same error. How can I help him to fix that?

 

[cPanelMichael]

I have a partner in China who was using foxmail without a problem. Just recently he is getting the same error. How can I help him to fix that?

Hello @Bernardohm,

You can either remove China as a blacklisted country in WHM >> cPHulk Brute Force Protection >> Countries Management or whitelist the user's individual IP address in WHM >> cPHulk Brute Force Protection >> Whitelist Management.

Thank you.