Didn't find what you were looking for?


We have advanced search options to make it easier to locate posts, questions and answers on this community.
More information can be found at Advanced Search Options
If you are looking for something specific, please check if someone else has already asked or answered the same question.

A note regarding upgrades and Network Evolution:
Customers will be notified by their preferred communication method (email or text) when upgrades are available in their area for a specific service address

Our domain and subdomains are being blocked by CUJO/Security Shield for no reason

henrytradecoffee26
henrytradecoffee26 Posts: 5 Novice
in Connectivity

Hi, our domain and subdomains are being blocked by CUJO for no reason, and every other reputation feed (VirusTotal + Spamhaus + APIVoid) is not corroborating why we're being blocked. We've already submitted unblock requests for drinktrade.com and *.drinktrade.com via https://www.spectrum.net/support/internet/how-unblock-website-security-shield but it could take 5 business days to process. What do we do? This is our business and is urgent.

Best Answer

  • James_M
    James_M Posts: 5,562 ✅ Verified Employee Moderator
    Answer ✓

    Hi -

    I am able to access https://www.drinktrade.com/ from our Spectrum network, so it does not appear to be blocked on Spectrums end.

    Can you provide more information about who is reporting the website being blocked? Have you reached out to CUJO as well?

Answers

  • henrytradecoffee26
    henrytradecoffee26 Posts: 5 Novice

    Hi James,

    Cujo does not list a way for us to contact them except through a sales channel. We tried anyways and are still waiting to hear back.

    I've attached the script that I'm running within my ISP (we are Spectrum Business customers as well) and it shows clearly when Cujo is blocking. Some subdomains are flapping, some are persistently blocked.

    This is what I'm seeing:

    1. HTTP (port 80) — CUJO intercepts and 302-redirects to its block page
      ──────────────────────────────────────────────────────────────────────
      GET http://go.drinktrade.com/
      → HTTP 302 Found
      → Location: https://block.charter-prod.hosted.cujo.io/warn.html?url=http://go.drinktrade.com/&token=4c9001a5
    2. The block page content (Spectrum Security Shield / CUJO)
      ──────────────────────────────────────────────────────────────────────
      "Suspicious Site Blocked — This site was blocked because it may contain
      unsafe content that can harm your device or compromise your personal info.
      Managing Security Shield: Residential customers can use My Spectrum App,
      Business customers can use Spectrumbusiness.net"
    3. HTTPS (port 443) — CUJO can't forge a cert, so it breaks the TLS handshake
      (this is what users experience as ERR_SSL_PROTOCOL_ERROR / "can't establish a secure connection")
      ──────────────────────────────────────────────────────────────────────
      GET https://go.drinktrade.com/
      → SSLError: [SSL: WRONG_VERSION_NUMBER] wrong version number

    These are the domains:

    • 🟢 Was blocked earlier in the day, but is coming up clean now:
      • www.drinktrade.com, drinktrade.com (apex) — 0/25
    • 🔴 Persistently blocked (every check):
      • go, go.qa, ss — 25/25
      • ss3.zone.drinktrade.com — confirmed blocked
    • 🟠 Flapping (intermittent) — blocked some checks, clear others:
      • Frequently (~80%+): help (21/25), qa-account-dev (21/25)
      • Often (~60–70%): roasters (17), pine-crest-7293-api (16), staging.roasters (16), trk (15)
      • About half: data (14), blog (13), ss2 (13), coffee-recommender-production (12), qa-account-dev-vincent (12), staging.app (12), cobalt-ridge-4821 (11), coffee-recommender-staging (11), sms (11)
      • Occasionally (~30–40%): trade-n8n-qa (10), links (9), staging.data (9), kbounces (8), buy (7)
      • Rarely: partners (5), share (2)
    • ✅ Resolved (de-listing confirmed): none yet — nothing has gone stable-clear while Shield is on.
    cujo-tracker.txt
  • James_M
    James_M Posts: 5,562 ✅ Verified Employee Moderator

    Thanks. Who is your web host?

  • henrytradecoffee26
    henrytradecoffee26 Posts: 5 Novice

    Cloudflare but main storefront is Shopify.

  • James_M
    James_M Posts: 5,562 ✅ Verified Employee Moderator
    edited July 14

    Thanks. Next step would be to contact the webhost, there is likely an update or setting that will need to be fixed to address the suspicious site message. They will also be able to see exactly what is causing the error.

  • henrytradecoffee26
    henrytradecoffee26 Posts: 5 Novice

    Hi James,

    Unless you can point me to a log message on your side indicating why Security Shield blocked any of the above domains I maintain that the issue with Security Shield / Cujo / Charter. We've had no changes in our Cloudflare instance in the past 24 hours (this started at 10a-ish today ET).

    Cheers,

    Henry

  • RAIST515O
    RAIST515O Posts: 326 Contributor

    The IP reported to myip.ms shows it got reported to blacklist in February (another report 6 years ago). IDK if there is any traction their, but considering THOUSANDS of sites could have used it because of the cloudhosting nature of things... could be some bad actors leaving breadcrumbs out there causing issues.

  • henrytradecoffee26
    henrytradecoffee26 Posts: 5 Novice

    Thanks RAIST515O, but that IP is Shopify's IP, so it's really not us. In the end we got to CUJO AI directly and they allowlisted us.

  • James_M
    James_M Posts: 5,562 ✅ Verified Employee Moderator

    Thanks for the update, glad to hear everything is back to working as expected!

Categories