Cumulus Support

Hi Ken

I noticed that my index page intermittently taking 30 seconds or more to load. I went through everything to try and figure out why, which took some time as I wasn't getting any information back in the developers tool of the browser. The very last thing I checked was the euwarnings script. I removed the widget from my index page and it fixed the issue. To be sure it was this, I went to the warning page on my site: https://warehamwx.co.uk/wxadvisory.php

And sure enough, it took 30 seconds to load. It is periodically happening, but it's frequent. Are you able to replicate it?

Edit:

Fresh info

Alas, I'm unable to replicate the issue. Your error message from curl shows a problem connecting to the Meteoalarm feed server, so it's an issue with connectivity between your webserver and their host (could be bad route, network fabric issue or ???).

To remove the excess delay from your homepage, you'd need to run get-meteoalarm-warning-inc.php via cron every 5 minutes.
Since the script doesn't directly load Settings.php, you'll need a starter script to run it via cron. Something like this 'run-meteoalarm.php' To run it in cron you need a cron schedule of '*/5 * * * *' and a command of (adjust the cd command for your document root, and /usr/local/bin/php to the instance of the PHP command on your webhost.)

Since you're not using the Saratoga template, you can remove the include_once("Settings.php"); and just configure get-meteoalarm-warning-inc.php with your settings.

fyi, my wxadvisory.php (via Ken's Saratoga Templates) is loading fine so I am guessing there is some sort of network issue from your hosting company.

Spoke to my host and they checked connections to meteoalarm. It looks like meteoalarm are blocking my server IP address.

I sent meteoalarm an email in regards to the problem. They actually replied in less than ten minutes.

They are going to look in to it. Fingers crossed!

Good morning,

Upon further investigation by our support team, it has been determined that the IP address is being blocked due to being identified as a “scanner”. Unfortunately, we are unable to take any action to restore access to this IP address from our end.

Apologies for the inconvenience caused. If you have any further questions or concerns, please feel free to let me know.

Kind regards,

Johannes

Well, that's the end of that then..

If your site is shown as a scanner that to me implies you are requesting data faster or more frequently than they expect. Is it possible to slow down or lower the frequency. Maybe ask them what sort of frequency is acceptable for pulling their data? My site pulls data from UKMO for weather warnings etc. and never had any issues but I'm using their RSS feed! Do they provide an RSS feed?

Stuart

The script settings are all default and it caches data. I don't know what the API limits are but even if it's a thousand a day, I shouldn't be anywhere near that. It was working fine for months up until a few days ago.

If they can't do anything about it then that suggests they use a centralised list to screen IP addresses for reputation - known as RBLs. If that is the case then your IP address has been labelled as a source of nefarious activity such as scammers or spammers or malware.

You can get your IP address removed from RBLs, but you will need to know which RBL it is on. You can find this out using tools such as those on offer (for free) from https://mxtoolbox.com.

If your IP address is shared then you will be at risk of being added again to a RBL if another user of the same IP address is up to no good.

It seems you're listed on one 'blocklist' as shown by https://dnsblcheck.de/dnsbl/warehamwx.co.uk.

It may have been one of the other listed sites hosted on your IP address that was doing naughty stuff and you were blamed by IP address:

Results for checks on 91.238.164.174
I have found 43 domains hosted on the same server:
6davies.com amg-group.co.uk baileyintabeats.com
barringtonjewellers.com belfastrestaurants.com bigbandbyrne.com
bluemustard.com carlesriba.com chalfontscouts.org
chief-officer.com chrissalt.com cobalt57.com
contour886.com cvsstalbans.org.uk dannyseward.com
deansfamily.com drakenphotography.com edwardhopkins.com
eight-freestyle.com emmaelliott.com enviro-core.com
garethharmer.com goingwalkies.com heathercowie.com
jaburt.com janefinnis.com jkvisuals.com
jmurtagh.com kingswaycap.com krakow-tours.com
lasteditionbeetle.org makeamillionnow.com mon-tv.com
pineapplethief.com plainsight.info reubenfoundation.com
shadyindustries.com startonomics.com strangely.org
sugarcube.net the-strand.net totalinfo.net
warehamwx.co.uk

I'd suggest you try the instructions at http://www.usenix.org.uk/content/rbl.html to get 99.105.57.13 removed from the all.s5h.net DNSbl list.

saratogaWX wrote: ↑Wed 24 Apr 2024 2:02 pm It may have been one of the other listed sites hosted on your IP address that was doing naughty stuff and you were blamed by IP address:

like shadyindustries.com

saratogaWX wrote: ↑Wed 24 Apr 2024 2:02 pm It seems you're listed on one 'blocklist' as shown by https://dnsblcheck.de/dnsbl/warehamwx.co.uk.

It may have been one of the other listed sites hosted on your IP address that was doing naughty stuff and you were blamed by IP address:

Results for checks on 91.238.164.174
I have found 43 domains hosted on the same server:
6davies.com amg-group.co.uk baileyintabeats.com
barringtonjewellers.com belfastrestaurants.com bigbandbyrne.com
bluemustard.com carlesriba.com chalfontscouts.org
chief-officer.com chrissalt.com cobalt57.com
contour886.com cvsstalbans.org.uk dannyseward.com
deansfamily.com drakenphotography.com edwardhopkins.com
eight-freestyle.com emmaelliott.com enviro-core.com
garethharmer.com goingwalkies.com heathercowie.com
jaburt.com janefinnis.com jkvisuals.com
jmurtagh.com kingswaycap.com krakow-tours.com
lasteditionbeetle.org makeamillionnow.com mon-tv.com
pineapplethief.com plainsight.info reubenfoundation.com
shadyindustries.com startonomics.com strangely.org
sugarcube.net the-strand.net totalinfo.net
warehamwx.co.uk

I'd suggest you try the instructions at http://www.usenix.org.uk/content/rbl.html to get 99.105.57.13 removed from the all.s5h.net DNSbl list.

Hi Ken.

When I click that first link, it says 'No findings for this check'

Thoroughly depressing that this goes on. I'll have to remove this script now, as it'll probably never work with my host.

That's actually good news. Now

No entry: usenix.org (all.s5h.net)

where your server was listed by IP.

Hopefully, the firewall block will update to let you through now that the prior BL listing is expunged.

I wonder how long it'll take? Still a no-go at the moment.

Send meteoalarm another email query.. ask them to cite the specific block lists(s) your ip is currently on.