Access Denied?

[aikatt]

When i c.lick on "Buy It Now" or "Go To Checkout", i get a page saying Access Denied You don't have permission to access "http://pay.ebay.com/rxo?" on this server. Reference #18.710fd717.1558368855.343ddcb The reference number changes. I have been on the phone to ebay for hours. This started happening a couple weeks ago, but now it's quite often. Purchases went ok Sunday, but Monday morning they all failed to go thru. Please fix whatever you "improved" to cause this.

[aikatt]

The shared vs dedicated ip arguement won't work here, the isp resets everyone's modem out here every 7 days or so, and we must power cycle the modem, and we get new addresses. Plus they turn the wifi back on, which my neighbor was apparently using a few years back to get porn,,,, and the isp sent me a letter about it. I removed the antennas. Neither Paypal or Ebay has been willing to discuss this as a problem or solution. Both places have layers of log-on authentification, the fickle ip changing, out of my control, by the isp is pretty poor auth.

[ohnojoey]

---

@aikatt wrote:
The shared vs dedicated ip arguement won't work here, the isp resets everyone's modem out here every 7 days or so, and we must power cycle the modem, and we get new addresses. Plus they turn the wifi back on, which my neighbor was apparently using a few years back to get porn,,,, and the isp sent me a letter about it. I removed the antennas. Neither Paypal or Ebay has been willing to discuss this as a problem or solution. Both places have layers of log-on authentification, the fickle ip changing, out of my control, by the isp is pretty poor auth.

---

I didn't mean it as an argument, just how I log into paypal with a VPN dedicated address.

A VPN dedicated address  never changes despite what your local ISP does or doesn't change. It's a separate service with a static address and not dependent on your ISP. Your ISP typically uses dynamic addresses. That's normal.

Actually, I don't know if you are using a VPN service or not and the things you describe are varied and unrelated. (porn, warnings, piggybacking neighbors)

"Plus they turn the wifi back on" 

Your service provider cannot turn your wireless on or off , nor does removing antennas turn it off, only you can choose from your own computer whether to use/activate wifi or a wired Ethernet connection, and if you do activate wireless, it is your responsibility to secure it so your neighbors cannot use it freely. Your ISP has nothing to do with that choice. 

Good luck with your problem.

[payton544]

Had this happen 3 times trying to make a purchase this week. Now I cant list anything, no access either, This is ridiculous

[aikatt]

Actually, @ohnojoey , they do have access to the dsl modem , they have their own password (unknown to me), can read my password and reset it, and have said they checked the settings more than once, and have reset the modem many times, thus re-enabling wifi. I never said removing the antennas would shut off wifi, but it sure limits the range of the signal. The neighbors are over 100ft away. Shutting off the dsl signal every Monday at 1am does cause a new ip to be assigned, as does rebooting the modem. So if someone local is causing the ip to be blacklisted, such as a neighbor piggybacking via my wifi, eventually every ip available out here will be blocked. I have not read of a vpn offering static ip addresses.

[ohnojoey]

Your ISP sounds like a nightmare! Sorry.

There are a lot of VPN's offering static addresses, but most reviews are probably biased but it gives an idea.

Just for example-

("There are websites that would not allow you to connect if you use a dynamic VPN service.

A dedicated, or static IP address is a feature that many people prefer because it can be very convenient when playing games, or using online banking services.

With a dedicated IP address, you can protect your identity and keep your connection secure, without experiencing issues when login to certain services and websites. .)

[tyler@ebay]

Hi @aikatt - I wanted to see if this is still occurring for you (and anyone else on the thread). Tech seems to think it is corrected, but I'd like to hear from you on it before I consider it resolved. 

Thanks!

[zombiecomponents]

You have been blacklisted by ebay's content delivery network provider

This is a specific Akamai CDN ip blocking message ... details here https://community.akamai.com/customers/s/article/Why-is-Akamai-blocking-me?language=en_US

basically it says that your ip assigned to your browser has been used for spamming or DOS attacks etc. This may be unrelated to anything you have done as the ip you use is likely dynamic. The spamming may have been done by someone else who had this ip before you.  However, you may have some malware on your system that is sending out spam and you don't even realize it. So make sure you clean up any possible malware on your system.

Dynamic ip's are assigned through your ISP. You may get a new ip regularly or you may have the one assigned to you a very long time. So the problem may go away if you disconnect your modem a few hours so that you get a new ip when you restart it, but that doesn't always work. 

you can confirm this and also ask to appeal the blacklisting here https://www.akamai.com/us/en/clientrep-lookup/

you can also contact your ISP and see if they can cycle the ip they assigned to your modem / router  which would change the ip you use and solve the issue.  If your ISP is unwilling or cannot do so, the only way around this is to get a VPN subscription and connect to Ebay through a VPN

[zombiecomponents]

there is a lot of posts on this scattered through the community ... and no one seems to have the right answer ... accept me which is listed below. This is a very specific error from your CDN. It would be worth posting a solution more visibly and consolidating the +20 threads on the subject

[aikatt]

I do not believe this is the answer, for several reasons, for instance you suggest using a VPN, which i have been using for many years, prior to and since this happening. When it happened with yet another computer, while not using the VPN, i went with a shotgun approach and began changing all setting on the non-VPN machine. Surprise - it's EITHER ... 1) in regards to "profile spoofing", a FireFox addon, which presumeably may occur too if the ip Ebay sees you on does not match the fingerprinting tracking number in the url. Why Ebay would care if i switch browsers, i don't know, i have several, but refuse Chrome because it "phones home" way too often. 2) some sites, presumeably Ebay too, cannot deal with any browser family or version numbers outside a restricted range, and the profile spoofer for Firefox has 100's of browser strings it can pretend to be. So it drops you back to the Ebay home page and, because it thinks you did this maliciously, it barfs on you. The solution seems to be either turn off the profile spoofer, or manually select a most common profile, before you buy or bid on the item, And then make sure the addon does not change again till you are done. It's slightly possible to use the browser's [Back] button to back up a few pages, change the profile again, and resume from there. So Ebay claiming this is a security thing for them is hogwash. This is a sloppy programming error in Ebay, to have a set list of acceptable browsers, and by default essentially crash on everyone else, "browser support" be bleeped. I've been online over 20 years, and used telnet to get email and webpages, and have written several internet clients, so i do have some clue.

[zombiecomponents]

Did you at least try and submit your ip on the link?  I have dealt with this more than once and I confirmed it with Akamai... most recently ...today.  I had some malware get installed spoofing as windows market apps.  See below

********************************************

Thank you for contacting Akamai Technologies.

Following our investigation into your request and based on the data we see on in our logs, we can share that IP xxx.xxx.xxx.xxx received a bad risk score since it performs SQL injection attempts against several hosts protected by Akamai. 

As we can see, these attacks started on December the 29th and it is still ongoing.

Once it will stop, your IP’s reputation score will decay, and you will be able to access Akamai protected sites within few days.

Regards,

Akamai Threat Operations Team

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please do not modify the email subject. (S)

[aikatt]

December 29? Yesterday? No no, this started many years ago. And it happened to others before i first posted about it. If i turn on the addon "profile spoofer" it will likely happen next time i browse to Ebay. You can try it without the FireFox addon, you can use wget on windoze or *nix to spoof browser type.

[zombiecomponents]

yes its been going on for years ...Akamai has been Ebay's CDN for years

[aikatt]

And you say Akamai is protecting Ebay right now by banning me because this computer still has malware doing SQL injection attacks on Ebay? Really, right now, i am banned, right now, because i am right now attacking Akamai or Ebay? Same with the other two computers, right now? So should i return all the stuff i bought this month?

[zombiecomponents]

if you are getting this message ...yes ... its from Akamai ... it is their server message ...it doesn't come from anyone else.

[zombiecomponents]

To further validate this... when you get this message you will also be blocked on other sites that the Akamai server hosts on their CDN. IT IS NOT AN EBAY PROBLEM AT ALL... IT IS AKAMAI .  This is a very common problem across many major domains. In truth it is not even a problem, this is doing what it was designed to do. It is a strong indicator for issues on the machines you are using to access these domains.

EXAMPLES ON OTHER MAJOR DOMAINS:

MICROSOFT:

• When you go to a Microsoft website that is hosted by the Akamai content delivery network (CDN), you frequently receive an "Access Denied" message that resembles the following:Access Denied You don't have permission to access "http://www.microsoft.com" on this server.Reference #18.85c5d617.1549635923.277a7a1"
• Cause: This issue occurs because of the measures that Akamai has implemented to protect its websites from denial-of-service attacks. If a single origin or source tries to connect too frequently, these measures automatically block any IP addresses from that origin or source. The exact thresholds that are used to determine when to block addresses are based on connection volume.

SYMANTIC:

Error

Access Denied" message that resembles the following:Access Denied You don't have permission to access "https://www.example.com" on this server.Reference #18.85c5d617.1549635923.277a7a1"

Cause

Akamai blocks some AWS source IPs and denies these requests.  Either one of the symptoms are observed

1. Main page  -- a block page
2. Sub-resource -- missing a banner or page is loaded corrupt/partial
3. Access Denied -- You don't have permission to access "http://website.com" on this server