• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

submitting pm blocked because of reverse. theplanet .com

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Comments // Problems etc.

View previous topic :: View next topic  
Author Message
AdamV
SF Mod
SF Mod


Joined: 06 Oct 2004
Posts: 24
Location: Leeds, UK

Offline

PostPosted: Sat Jun 11, 2005 1:57 pm    Post subject: submitting pm blocked because of reverse. theplanet .com Reply with quote

I have some very basic keyword and domain blocking configured in my netgear firewall.
whenever I now submit a pm (but not a thread post) I get the following in my router logs (and I get a blocked page in my browser as I would expect)

Sat, 2005-06-11 12:22:23 - TCP Packet - Source:192.168.10.10,1375 Destination:137.67-18-103.reverse.theplanet.com,80 - [BLOCK]
Sat, 2005-06-11 12:36:42 - TCP Packet - Source:192.168.10.10,1390 Destination:137.67-18-103.reverse.theplanet.com,80 - [BLOCK]

the source address is correct for this machine I am on.

I sent a pm earlier today with no issue and have not installed anything nor followed links since.

I thought I would post it in this section because some searching seems to indicate this might be a valid service provider used by some web sites for traffic measuring (for site stats etc). Is this the case or should I be looking for something more malicious and moving my post to a general help section? (Norton full AV scan just came up blank)

Behaviour is identical in Firefox 1.03 and IE 6sp2

If I try and pm a blank message or no topic I get errors back as I should.

The blocking would imply that the keywords of the target page are disallowed by my rules. I will try to work out which one may be causing the problem.

edit: just sent a test pm with subject 'test' and message 'test'. No problem, straight to outbox. So it seems this is related to the message body which would imply some kind of adware or whatever. Hmmm... more testing required, but still useful to know if there is anything legitimate here before I get HJT on the case.

edit2: AdAware and SpybotS&D came up with nothing except a bunch of tracking cookies, many of which I recognised (eg the ad trackers used by theregister). Turned off blocking and instead of block I got an error that I had sent a "Bad Request". I returned to the pm and removed the '...' I had included in the subject. Now resent and all was well. Now turned blocking back on but still puzzled.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Comments // Problems etc. All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register