August 9, 2020 at 4:12:51 PM UTC
VERIFY
Anomaly
DNS tampering
Websites
Runtime: 3.2s
On August 9, 2020 at 4:12:51 PM UTC, http://www.metacrawler.com/ presented signs of DNS tampering on AS6697 in Belarus.
This might mean that http://www.metacrawler.com/ was blocked, but false positives can occur.
Please explore the network measurement data below.
Failures
HTTP Experiment
null
DNS Experiment
null
Control
null
DNS Queries
Resolver:
127.0.0.1
Query:
IN A www.metacrawler.com
Engine:
system
Name
Class
TTL
Type
DATA
Answer IP Info
@
IN
CNAME
lbr-bouncer.inspcloud.com
Unknown AS
@
IN
A
3.230.20.113
Unknown AS
TCP Connections
3.230.20.113:80: succeeded
HTTP Requests
URL
GET http://omblockedips.com/?honeypot¶ms=ysnzRYVQ1Rv1wEnnf5v42zaO-UmgDYotqks8vGigebML2hKzSKmtwhI1xcZjsSch0q_4O2FYV0MoqDnU0PQK8BWBTxPP2FeEE7jzlKj3hlC__aZoSAdk2DA-AIqmSAlIyZOVyD23GhTYkahtYxmgz2fEXIF2mg4W82fi0wHTAf_hKKdD01HUKqr1a9raRCszO3JaGLOzfSMjZ1yMuA
Response Headers
Content-Length:5528Vary:Accept-EncodingServer:nginxConnection:keep-aliveDate:Sun, 09 Aug 2020 18:12:55 GMTContent-Type:text/html; charset=utf-8
Response Body
<!doctype html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
<style type="text/css">
/*! normalize.css v7.0.0 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,footer,header,nav,section{display:block}h1{font-size:2em;margin:.67em 0}figcaption,figure,main{display:block}figure{margin:1em 40px}hr{box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent;-webkit-text-decoration-skip:objects}abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}b,strong{font-weight:inherit}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}dfn{font-style:italic}mark{background-color:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}audio,video{display:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display:table;max-width:100%;padding:0;white-space:normal}progress{display:inline-block;vertical-align:baseline}textarea{overflow:auto}[type=checkbox],[type=radio]{box-sizing:border-box;padding:0}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-cancel-button,[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}
@import url(https://fonts.googleapis.com/css?family=Roboto);
body {
font-family: Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;
background: #f2f2f2;
padding: 10px;
}
.wrapper {
margin: auto;
max-width: 900px;
background: #fff;
border-radius: 2px;
box-shadow: 0 1px 2px lightgrey;
padding: 1em 2em 2em;
}
h4 {
margin: 1em 0;
}
.headline-container {
text-align: center;
}
.headline {
font-size: 24px;
font-weight: lighter;
}
.captcha-container {
margin: 0 auto;
text-align: center;
}
img {
width: 100%;
max-width: 250px;
}
textarea {
width: 100%;
max-width: 300px;
min-height: 70px;
padding: 5px;
font-size: 12px;
margin: 10px 0 0;
border-radius: 2px;
}
.reload-container {
font-size: 11px;
text-align: center;
margin-top: 10px;
}
.g-recaptcha>div {
margin: 0 auto;
}
.submit-container {
text-align: center;
}
button,
[type=submit] {
background-color: #ddd;
background-image: -webkit-linear-gradient(rgba(255,255,255,1), rgba(255,255,255,0));
background-image: linear-gradient(rgba(255,255,255,1), rgba(255,255,255,0));
border-radius: 3px;
border: 1px solid #d3d3d3;
box-shadow: 0 1px 0 rgba(0, 0, 0, .3), 0 2px 2px -1px rgba(0, 0, 0, .5), 0 1px 0 rgba(255, 255, 255, .3) inset;
color: #555;
cursor: pointer;
font: bold 13px arial, helvetica, sans-serif;
padding: .75em 2em;
text-decoration: none;
text-shadow: 0 1px 0 rgba(255,255,255, .9);
white-space: nowrap;
}
</style>
<script>
function reload() {
window.location.reload(true);
}
</script>
<script src="https://www.google.com/recaptcha/api.js" defer></script>
</head>
<body>
<div class="wrapper">
<form action="validate">
<div class="headline-container">
<h4 class="headline">To continue, please respond below:</h4>
</div>
<div class="g-recaptcha" data-sitekey="6LfC5TIUAAAAAMUwDLQ9UBbuhLjE8LTRDH1h1Hb1"></div>
<br>
<input type="hidden" name="params" value="B88sfUr-iXyMkRXglB_sfQky4_Xr-sDeqmXaX58OMnISXYrjp7gQOFEDRf_4VEmSBmJDtwYJFbC8njrlOMBs2r-MleHb54X_e8T_uMdkvp5tYFgvTSXJ-2Gw1UF1vyaydnGmw4pvntf2-pkElBhtuRS73Rr7OAx95wi4cff1wwjqVOCJnBjNHiYJBaFZJJdrtIcWI3FftuZ5nhUz">
<div class="submit-container">
<input class="captcha-submit-button" type="submit" value="Submit">
</div>
</form>
</div>
</body>
</html>URL
GET https://www.metacrawler.com/
Response Headers
Content-Length:717Server:openresty/1.11.2.2Connection:keep-aliveLocation:http://omblockedips.com/?honeypot¶ms=ysnzRYVQ1Rv1wEnnf5v42zaO-UmgDYotqks8vGigebML2hKzSKmtwhI1xcZjsSch0q_4O2FYV0MoqDnU0PQK8BWBTxPP2FeEE7jzlKj3hlC__aZoSAdk2DA-AIqmSAlIyZOVyD23GhTYkahtYxmgz2fEXIF2mg4W82fi0wHTAf_hKKdD01HUKqr1a9raRCszO3JaGLOzfSMjZ1yMuADate:Sun, 09 Aug 2020 18:12:54 GMTContent-Type:text/html; charset=utf-8
Response Body
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <title>Redirecting...</title> <h1>Redirecting...</h1> <p>You should be redirected automatically to target URL: <a href="http://omblockedips.com/?honeypot&params=ysnzRYVQ1Rv1wEnnf5v42zaO-UmgDYotqks8vGigebML2hKzSKmtwhI1xcZjsSch0q_4O2FYV0MoqDnU0PQK8BWBTxPP2FeEE7jzlKj3hlC__aZoSAdk2DA-AIqmSAlIyZOVyD23GhTYkahtYxmgz2fEXIF2mg4W82fi0wHTAf_hKKdD01HUKqr1a9raRCszO3JaGLOzfSMjZ1yMuA">http://omblockedips.com/?honeypot&params=ysnzRYVQ1Rv1wEnnf5v42zaO-UmgDYotqks8vGigebML2hKzSKmtwhI1xcZjsSch0q_4O2FYV0MoqDnU0PQK8BWBTxPP2FeEE7jzlKj3hlC__aZoSAdk2DA-AIqmSAlIyZOVyD23GhTYkahtYxmgz2fEXIF2mg4W82fi0wHTAf_hKKdD01HUKqr1a9raRCszO3JaGLOzfSMjZ1yMuA</a>. If not click the link.
URL
GET http://www.metacrawler.com/
Response Headers
Content-Length:193Server:openresty/1.11.2.2Connection:keep-aliveLocation:https://www.metacrawler.com/Date:Sun, 09 Aug 2020 18:12:53 GMTContent-Type:text/html
Response Body
<html> <head><title>307 Temporary Redirect</title></head> <body bgcolor="white"> <center><h1>307 Temporary Redirect</h1></center> <hr><center>openresty/1.11.2.2</center> </body> </html>
Resolver
Resolver ASN
AS20473
Resolver IP
207.246.87.132
Resolver Network Name
Choopa, LLC
Measurement UID
012020080993bcd3549dd6650657b7b510cb7122
Report ID
20200809T161759Z_AS6697_6I3t4ZBhLNGf53b2T9aZC2mvHgyOGT9RuYl0LoFYK3kdGI37im
Platform
windows
Software Name
ooniprobe-desktop (3.0.3)
Measurement Engine
libmeasurement_kit (0.10.11)