9xbuddy.org

[GuarDian]

Hello everyone, I am not sure honestly where this inquiry would go so I posted it here, I am sorry if it is the wrong place and hope you can move it accordingly if need be.

I was using 9xbuddy.org to download a 1080 version of a YouTube video for one of my daughter's courses so she can refer to it offline for school, I noticed that the provided link (on IPs 51.15.143.134 and 51.15.136.68) was blocked based on this rule (which was odd because if I understand my RegEx correctly, these IPs don't have .158 second part at all but they do seem to be from the same "ip pool" based on whois records so maybe that's why):

Code: Select all

/(https?:\/\/)51\.158\..{100,}/$document

and I tried searching for some information on why it might be considered "malicious" or "unwanted" to see what if anything is the concern with it so I can decide accordingly to "allow" or "temp allow" it or not, alas I couldn't find anything to help me understand it.

I was hoping someone would kindly tell me what the reasoning for blocking this was so I can better understand the ramifications of allowing it to continue which downloads the MP4 file that was expected, appreciate any clarification. Analyzing the files, they are clean and unaltered in any malicious way but in the meantime based on trust for this list, I am only temp allowing until I know better.

Thank you in advance. I am using: uBlock Origin / 1.29.2 / EasyList 202010090439 /and I am not sure if you need it or care, but I am on Opera 71.0.3770.228 if that helps you. Let me know if you need anything else, I put down what I could think would be useful to you.

[intense]

I get no 51.* ip

[LanikSJ]

Just like this forum 9xbuddy.org uses CloudFlare so the 51.* could be local to where the OP resides.

EDIT: One of those IP belongs to:

Code: Select all

route:          51.15.0.0/16
descr:          SCALEWAY
descr:          Paris, France
origin:         AS12876
mnt-by:         MNT-TISCALIFR
created:        2018-03-28T18:01:19Z
last-modified:  2019-10-03T15:13:21Z
source:         RIPE

[intense]

I am on Opera 71.0.3770.228 if that helps you

Are you using vpn in opera ?

Eventually open uBO logger and post here the screenshot(s) with the blocked items

[Dandelion Sprout]

All I can say for sure, is that /(https?:\/\/)51\.158\..{100,}/$document is not supposed to block e.g. 51.15.0.0, because it's supposed to block e.g. 51.158.0.0.

So that sounds to me personally more like a glitch in uBlock Origin or in your (GuarDian) uBO configuration.

[GuarDian]

I am so sorry everyone, I never got a notification from the board that any replies had come in. Forgive the delay.

This happened this morning, I came to post it as additional information:

http://51.158.145.228/down/Onl0OlJTbDg3 ... 1602884241

Because of the following filter:

Code: Select all

/(https?:\/\/)51\.158\..{100,}/$document

[GuarDian]

Just like this forum 9xbuddy.org uses CloudFlare so the 51.* could be local to where the OP resides.

That's what I figured, as I said maybe part of a larger IP pool that got snagged. SO long as that is the only reason, I am ok whitelisting it, just wanted to be sure. Thank you.

[GuarDian]

Are you using vpn in opera ?

No I am not.

Eventually open uBO logger and post here the screenshot(s) with the blocked items

If you tell me what I am looking for to provide you, I would happily look into the logger for it.

[GuarDian]

All I can say for sure, is that /(https?:\/\/)51\.158\..{100,}/$document is not supposed to block e.g. 51.15.0.0, because it's supposed to block e.g. 51.158.0.0.

So that sounds to me personally more like a glitch in uBlock Origin or in your (GuarDian) uBO configuration.

Correct and I agree, I didn't see that it would ensnare the ip either but as Lanik pointed out, I thought maybe it was because the requests were coming from a wider range that just weren't front facing. I added the one that happened this morning, if that helps.

[LanikSJ]

I am so sorry everyone, I never got a notification from the board that any replies had come in. Forgive the delay.

My turn to apologize as those don't actually work right now viewtopic.php?f=9&p=156720

[intense]

If you tell me what I am looking for to provide you, I would happily look into the logger for it.

select all the blocked items then post here as 1 or more screenshots

[GuarDian]

My turn to apologize as those don't actually work right now viewtopic.php?f=9&p=156720

I am sorry didn't mean it like that, I didn't know it was a known issue, I thought it was me honestly. Thanks for letting me know.

[GuarDian]

select all the blocked items then post here as 1 or more screenshots

I am sorry if I am being daft, but don't see where I would get you that given that it doesn't block it in such a way that I can get anything from the "logger" like we normally do, unless of course I am being completely dumb and overlooking something trivial.

The only indication of a block I have is this, which stops it dead in its track:



and opening the logger on this page (before or after this alert) shows nothing at all because apparently no request has been initiated so there is nothing logged there and temporarily allowing it just allows it so again nothing blocked, I could be wrong and welcome more instruction to accommodate.

[LanikSJ]

select all the blocked items then post here as 1 or more screenshots

I am sorry if I am being daft, but don't see where I would get you that given that it doesn't block it in such a way that I can get anything from the "logger" like we normally do, unless of course I am being completely dumb and overlooking something trivial.

I think what intense means is the logger feature of uBO: https://github.com/gorhill/uBlock/wiki/The-logger