OP said the blocked site he is trying to access also uses cloudflare certificate
-
Amazon Deals - ToS - Warp
How is Airtel Blocking Even https:// Sites?
- Thread starter apuw
- Start date
- Replies 55
- Views 21,657
well he mentioned 1 3 3 7 x in his first post. if that website was using cloudflare, it should not work on https for me as well. but it does work for me on excitel. but not on airtel. whenever i switch to airtel, it barely takes 2 minutes to land on a domain that is blocked on it. things are so so bad on airtel.
leetx is on cloudflare.
Domain: --deleted---
Created on: Sat Apr 05 03:57:24 2014
Last edited on: Fri Feb 12 03:06:51 2016
Expires on: Thu Apr 05 03:57:24 2018
Primary host add: None
Primary host name: olga.ns.cloudflare.com
Secondary host add: None
Secondary host name: todd.ns.cloudflare.com
Results from checking SOA records for listed servers:
olga.ns.cloudflare.com: 2025609928
todd.ns.cloudflare.com: 2025609928
Domain: --deleted---
Created on: Sat Apr 05 03:57:24 2014
Last edited on: Fri Feb 12 03:06:51 2016
Expires on: Thu Apr 05 03:57:24 2018
Primary host add: None
Primary host name: olga.ns.cloudflare.com
Secondary host add: None
Secondary host name: todd.ns.cloudflare.com
Results from checking SOA records for listed servers:
olga.ns.cloudflare.com: 2025609928
todd.ns.cloudflare.com: 2025609928
Interesting analogy but it falls flat as Airtel is not only reading which websites the traffic is going to and blocking them but also injecting said sites with the DOT notice even on https://.
But they are injecting data into the https:// stream by showing the DOT notice on the https:// page itself without redirecting.
Edit: I was wrong! I stand corrected thanks to @Karan who's been on fire with the links and info he has posted. According to the great blog post that was linked what Airtel is doing is it terminates the connection to the blacklisted website as soon as it realizes and adds the DOT iframe. So it is not directly injecting data into https:// websites.
They indeed seem to be using Netsweeper to do this. We can confirm this by looking at the example provided in the article (Though Julius Plenz identified the equipment being used as Cisco in the blog it is indeed Netsweeper as we'll see below).
Article iframe example:
Airtel iframe currently being loaded:
We can see above that many URL parameters match such as: dpid, dpruleid,
dplanguage, url= and the width and height being 100%. These values are attributed to Netsweeper in the Citizelab report about Netsweeper:
Boom there you have it @Karan was correct and Airtel is indeed using Netsweeper to block websites in India. @Sushubh hope you can put this information somewhere for future visitors.
Also recommend reading the Citizen Lab report: https://citizenlab.ca/2016/09/tender-confirmed-rights-risk-verifying-netsweeper-bahrain/
They indeed seem to be using Netsweeper to do this. We can confirm this by looking at the example provided in the article (Though Julius Plenz identified the equipment being used as Cisco in the blog it is indeed Netsweeper as we'll see below).
Article iframe example:
Code:
<iframe src="http://94.201.7.202:8080/webadmin/deny/index.php?dpid=20&
dpruleid=7&cat=105&ttl=0&groupname=Du_Public_IP_Address&policyname=default&
username=94.XX.0.0&userip=94.XX.XX.XX&connectionip=1.0.0.127&
nsphostname=YYYYYYYYYY.du.ae&protocol=nsef&dplanguage=-&url=http%3a%2f%2f
pastehtml%2ecom%2fview%2fc336prjrl%2ertxt"
width="100%" height="100%" frameborder=0></iframe>
Code:
<iframe src="http://www.airtel.in/dot/?dpid=1&dpruleid=3&cat=107&dplanguage=-&url=http%3a%2f%2f1337x%2eto%2f" width="100%" height="100%" frameborder="0"></iframe>We can see above that many URL parameters match such as: dpid, dpruleid,
dplanguage, url= and the width and height being 100%. These values are attributed to Netsweeper in the Citizelab report about Netsweeper:
Boom there you have it @Karan was correct and Airtel is indeed using Netsweeper to block websites in India. @Sushubh hope you can put this information somewhere for future visitors.
Also recommend reading the Citizen Lab report: https://citizenlab.ca/2016/09/tender-confirmed-rights-risk-verifying-netsweeper-bahrain/
Haha! nicely done, you basically found all the details that led me to this as well. It was the Citizen Lab report that actually gave me the name to company that has developed the tech, Netsweeper. I was just being too lazy to publish my full findings. 😛
The interesting part is, earlier, the airtel URL was basically the same and did include further details like your IP, your DSL user ID and even the location of the server, Mumbai! They seem to have truncated it, a bit. But it was indeed the "dpruleid" "dpid" etc that led me down this rabbit hole.
Oh, I see. I have gotten so used to of it, I actually have the iframe blocked by adblock so haven't paid much attention to it off late. Whenever the page loads blank, I assume it is the block page, I turn on my proxy and browse the blocked webpage. 😛