Very weird Geo Location issue

[iansays]

I have Sonic service in downtown San Jose, shared with my condo complex and i get an ethernet handoff which goes into a Eero router and then a mesh wifi. Have had this service since November 2023.

I manage a few Google Workspace domains for myself and for a few clients.

From home, on Monday, May 27, I attempted to access the Google Workspace admin console, and I was prompted to reenter my password and then told that "Service Unavailable" and "This service is unavailable in your country."

I tried with the other 3 GW domains I manage and got the same message. There was a "learn more" link, which I clicked and read that certain countries (North Korea, DRC, a few others) were blocked from using some Google services. I'm in San Jose, of course, so that can't apply to me.

I went back to my Gmail web interface and looked at the "Details" link at the bottom of the page where you can view Activity on this account, including the type of access (Browser, mobile), the IP (sometimes IPv4, sometimes v6, sometimes both) and the date and time. To my shock, my public v4 IP was listed as being in Iran.

I did an ARIN WhoIS lookup of my public IP and it showed, of course, that it was a US Based IP that belonged to Sonic.net. I further did a geo-IP lookup that gave my physical location almost down to my (correct) city block.

It was about this time that I also noticed some apps and websites were slow to load or would not load at all. Specifically the Burger King app on both an android phone and tablet and also my wife's iPhone. Websites included several travel blogs that are apparently hosted in similar environments, sharing whatever IP resources they use.

The only way I could get to the Google Workspace console was to disconnect from local wifi and use cell data. Any attempts to connect while on my home WiFi and using my Sonic public IP resulted in the same app & website errors, and the lack of access to the Console. Trial and error also allowed me to use my VPN client on both the PC and mobile, and I also discovered if I turned off IPv4 on the laptop's NIC and only used v6, the problem went away.

I was able to get to the Console and initiate a helpdesk chat with Google support. To say they were unhelpful would be...charitable. They couldn't deny my screenshots of Gmail activity saying my IP was based in Iran, nor could they conclude anything but that my IP was definitely in San Jose, CA and provided by Sonic, based in Santa Rosa. Other than the usual 'try incognito more' (same result) and send us your HAR file (Chrome log of activity while performing task within Chrome), they passed me around like a bottle of cheap Zinfandel. No one could possible fathom that the mighty Google had erred in mapping my IP to Iran.

It took a day and a half and hours upon hours to be directed to this page:

https://support.google.com/websearch/workflow/9308722

Which apparently lets you submit corrections to whatever resource Google pulls it's location data from in regards to IP.

I made the request and about 12 hour later, my IP started showing up as United States (CA) again.

I can now access the GWC for admin functions, but apps on my mobile devices still won't work and certain websites still won't load. If I switch away from my Sonic IP or turn on my VPN, access is restored. My working theory is that those apps and websites somehow subscribe to the same resource as Google, or use Google itself to vet the geo location of IPs and they don't refresh often enough.

Anyone have any idea what might have caused this? Is it possible someone in my building allowed (knowingly or unknowingly) allowed our IP to be used as a VPN out-point IP for traffic from Iran? Maybe a TOR node or similar?

Thanks to any who made it this far.


Ian
(not Iran)

[virtualmike]

You mentioned that you connected to VPN. Was that Sonic's OpenVPN that's available to all members? Or some other VPN?

[iansays]

I was not using Sonic's VPN.

I tested with a commercial (paid) VPN that I use when traveling, Hotspot Shield, as well as VPN'ing into several corporate networks I have access to via the Windows VPN client and AnyConnect from Cisco.

Even as of today, I am still unable to access many websites (from my laptops) and apps (from my mobile devices), when I use my 'regular' internet connection with my Sonic public IP. It's a nuisance, but not debilitating.

It WAS debilitating for the several days I could not access the Google Workspace console, but that part of the problem is resolved. I'd still like to know why a Sonic public IP was conflated with traffic from Iran, and find out if I can resolve the knock-on effects of that still-lingering data that affects current access.

And I'm sure that this is also affecting the other people in my building who share my public IP. They may not have needed access to the Google Workspace Console, but I'd be sure their access to the sites and apps I can't get to is the same.

[virtualmike]

I wonder if you were to connect to Sonic VPN if you'd get a Santa Rosa or San Jose IP address. I always get one of those, no matter where I happen to be physically when I connect.

[js9erfan]

Problem could be twofold; incorrect geolocation by Google and it could be your IP is on a blacklist due to suspect activity - especially if your whole complex is sharing the wan IP. You could check an IP reputation site like Talos, etc. I would be cautious on a shared network if there are other managed devices (router, switch, etc.) in the complex sitting upstream between your eero and Sonic. My 2c anyway...

[jmehnle0]

I wonder if something recently changed in some WHOIS databases, because starting this (Friday) morning, I'm unable to connect to github.com. githubstatus.com says that everything is operating normally, but all my IP-level connections to github.com infrastructure seem to be dropping on the floor: ICMP (ping), SSH to github.com, even HTTPS to github.com. Could GitHub be thinking that I'm in Iran?

[olivierlefloch]

Can confirm the GitHub.com connection issues ; other websites seem unaffected, as does docs.github.com ; Third party VPN connections to GitHub.com work.

[iansays]

I'm able to get to GitHub.com without resorting to a VPN or turning off IPv4 on my NIC.

EDIT: I see now that the github and other sites issue has been resolved. So, no ayatollah connection.

js9erfan, my Sonic IP is rated "Neutral" on Talos. I didn't include that in my original post, but it's something that I checked along with the ARIN lookup. The only other managed devices upstream from me & my Eero is/are the Sonic equipment. I assume they have a router/switch and fiber transceiver upstream from me and my neighbors in the complex.

As of right now, I'm still unable to access some websites and use some apps on mobile devices (android and iOS).

Healthy eating choices aside, I can get to the Burger King website, but it won't load any info, like letting me choose a local location and/or even look at the menu when I tell it my zip code. Likewise the app loads on mobile, but I can't choose a store or look at menus. "Looks like something went wrong," is all I can get. If I use a VPN or turn off IPv4, it works fine.

And pinging the websites I can't access times out, similar to jmehnle0 & olivierlefloch's description of GitHub.

One of those websites is:

https://viewfromthewing.com

Can't reach that on my laptops or mobile as long as I'm originating from my static Sonic IP. And when I say "my" static IP, what I really mean is my building's static IP, which may or may not actually be "static" in the common sense of the word, but it's been the same IP since as long as I can remember.

My current theory is that one of my neighbors might have allowed a relative or friend in Iran to VPN into their LAN and who or whatever is tracking such things picked up on that. My understanding is that those that track these things often look at where your DNS queries are getting answers from and if your DNS server is in Iran, even if you are using an IP in San Jose, CA, the IP could be conflated with Iran.

My most recent missive from Google Support said:

Hello Ian,
Greetings for a day,
After checking with the internal team you must block users in Iran from accessing the internet through their IP address.

- After several weeks of not having any signals of users outside california.at this IP address, the system should auto-correct and the IP address will be assigned back to california.

It is recommended that you block any users in Iran from accessing the internet through your IP address. If any users outside of california are accessing the internet through your IP address, this may affect how the IP address is mapped. After a few weeks of blocking non-california internet users from your IP address, the system should auto-correct and the mapping will be returned to california.


I'm not sure how I'm expected to "block users in Iran" or why it would take weeks of monitoring traffic from my IP to conclude it wasn't being used from Iran, but they said what they said. I'll take it with a grain of salt.


Ian

[iansays]

Slight bit of collaborating data:

I looked up the IP of one of the sites I can't get to, and it's a Google Cloud Platform IP: 35.227.46.114

Another site that shares that IP that I can't get to (though I didn't know it until I tried):

http://dealswelike.com/

So this jives with the idea that Google has marked my IP as one not to communicate with.

It doesn't explain why when I look at my "Activity Detail" in the Gmail web client I see "California, USA" now instead of Iran, like I did when this started happening, nor why I can now access the Google Workspace Console, which is what started this odyssey.

[js9erfan]

js9erfan, my Sonic IP is rated "Neutral" on Talos. I didn't include that in my original post, but it's something that I checked along
with the ARIN lookup. The only other managed devices upstream from me & my Eero is/are the Sonic equipment. I assume they have a router/switch and fiber transceiver upstream from me and my neighbors in the complex.

As of right now, I'm still unable to access some websites and use some apps on mobile devices (android and iOS).

Healthy eating choices aside, I can get to the Burger King website, but it won't load any info, like letting me choose a local location and/or even look at the menu when I tell it my zip code. Likewise the app loads on mobile, but I can't choose a store or look at menus. "Looks like something went wrong," is all I can get. If I use a VPN or turn off IPv4, it works fine.

And pinging the websites I can't access times out, similar to jmehnle0 & olivierlefloch's description of GitHub.

One of those websites is:

https://viewfromthewing.com

Can't reach that on my laptops or mobile as long as I'm originating from my static Sonic IP. And when I say "my" static IP, what I really mean is my building's static IP, which may or may not actually be "static" in the common sense of the word, but it's been the same IP since as long as I can remember.

Have you tried bypassing the eero to see if its blocking access to those sites? Are you using Sonic dns on the eero or other? A traceroute to those sites wouldn't hurt either... For what its worth I can access those sites without issue via Sonic fiber.