Getting blocked by Immunify360 while accessing the forum

[caseih]

So today I got blocked trying to access the forum by a warning about unusual activity from my IP address and I had to take those infuriating robot tests. Can the forum administrators do anything to figure out why Immunify360 was blocking me? It would be helpful to know what's triggering the block and to see if I can change anything in my configuration to stop this nonsense, or identify is some kind of malware is doing bad things with my computers. My machine is the only machine ever that talks to freebasic.net and it's Linux.

[fxm]

A similar thing happened to me twice in November 2017, then nothing since:

When submitting the above post, freebasic.net just asked me to confirm that I am not a robot!
This is the first time this has happened on the website.

• (10 Nov 2017, viewtopic.php?p=239076#p239076)

When updating my above post, freebasic.net just asked me to confirm that I am not a robot!
This is the second time this has happened on the website (first time: Nov 10, 2017)!

• (29 Nov 2017, viewtopic.php?p=240160#p240160)

[MrSwiss]

Had that too, last time on Saturday, 2nd of March, 2019 ...

Seems to only happen, when postings contain code/quotes/etc.
Aka: when posts are of a certain size, which seems to result in a
timeout (which then activates that immunifier, as useless as it is).

[paul doe]

Yeah, it happened to me too. In my experience, this happened when I post something, then immediately edit it, and when reposting, it triggers the blocking. Happened to me more times than I care to remember...

[caseih]

Right. So far it happened just once, thank goodness. I've seen this on several other web sites I visit lately, so I wonder if there's something about my configuration that's triggering it.

When I checked into Immunify360 I read that it uses machine learning to identify and block attacks. That tells me even its creators can't tell me why it blocks or what to do about it. Brave new world where we turn everything over to algorithms.

[Provoni]

Brave new world where we turn everything over to algorithms.

Straight out of science fiction!

:-)

It never happened to me though.

[MrSwiss]

Just happened again, while uploading "using ENUM" (Tips & Tricks) ...

I've done a few "preview's" and edits, then "submit" which failed.
A second try succeeded (after dealing with Immunify360).

Btw. the graphics in the "captcha", have a rather abysmal quality, which makes
it rather difficult to handle (actually to see properly, whether there is, what is
asked for, or not). In short: a pain in the rear-end.

[counting_pine]

Immunify360 is not something I know anything about - I've never seen it, and I don't know "where" it's coming from (the forum, the web server, the hosting network...)
Possibly it's something worth asking Plasma about.

EDIT: Hmm, I've found settings for 'imunify360' in the CPanel for freebasic.net, but it looks like it's disabled there.
I've changed its Proactive Defense settings from Disabled to Log only, but if something is blocking people before then, it may not log anything I guess.

[MrSwiss]

Thanks counting_pine, we'll just have to "wait and see", if the behaviour is okay now ...

[caseih]

If your cpanel shows it disabled, then I'm guessing the hosting provider is running it at a higher level.

I've never been a fan of rechaptcha, or any chaptchas really. They are horrible solutions to a difficult problem. Lately I've found I trip the robot checks a lot on various sites, and I wonder if it has to do with blocking all external javascript, and running ublock origin. It's just not safe to browse the web without those two (or similar) extensions. In rare circumstances I'll whitelist a site. But even then I get those captchas and sometimes immunify-like alerts, so there must be more to it.

[MrSwiss]

If your cpanel shows it disabled, then I'm guessing the hosting provider is running it at a higher level.

Considering what caseih noted: you just might gain some finer-grained control, if
you actually "enable" it, in the CPanel (just assuming, here). Some options might
pop up, currently hidden (using defaults), probably worth a try ...

[counting_pine]

If your cpanel shows it disabled, then I'm guessing the hosting provider is running it at a higher level.

Considering what caseih noted: you just might gain some finer-grained control, if
you actually "enable" it, in the CPanel (just assuming, here). Some options might
pop up, currently hidden (using defaults), probably worth a try ...

There aren't many settings to play with there. There wasn't much to disable - the only thing I could was already disabled. I set it to log things, and it hasn't logged anything since then, so I think caseih is right that it's happening on another level.
I've sent an email to Plasma anyway.

[counting_pine]

Plasma says he has disabled ModSecurity.
Please let us know whether there’s any improvement.
If it still happens, the problem probably lies elsewhere (and we should also probably consider reenabling ModSecurity if it’s not causing problems, to help keep the site secure.)