I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a `bit.ly` link, but it is blocked by my University. Knowing a bit of HTTP requests and basic network stuff, I initially suspected a DNS block. But even after changing to google DNS, I was getting the blocked page error. I used nslookup, both from my command line as well as a web utility, and got one of the servers as `67.199.248.10`. I used chrome to inspect the request, and indeed, the domain was being resolved to that IP. I even used curl on my local machine, and got this output: $ curl bit.ly -v * Rebuilt URL to: bit.ly/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 67.199.248.10... * TCP_NODELAY set * Connected to bit.ly (67.199.248.10) port 80 (#0) > GET / HTTP/1.1 > Host: bit.ly > User-Agent: curl/7.56.1 > Accept: */* > < HTTP/1.1 403 Forbidden < Content-Type: text/html; charset="utf-8" < Content-Length: 1272 < Connection: Close < { [1272 bytes data] 100 1272 100 1272 0 0 1272 0 0:00:01 --:--:-- 0:00:01 5412<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><style type="text/css">html,body{height:100%;padding:0;margin:0;}.oc{display:table;width:100%;height:100%;}.ic{display:table-cell;vertical-align:middle;height:100%;}div.msg{display:block;border:1px solid #30c;padding:0;width:500px;font-family:helvetica,sans-serif;margin:10px auto;}h1{font-weight:bold;color:#fff;font-size:14px;margin:0;padding:2px;text-align:center;background: #30c;}p{font-size:12px;margin:15px auto;width:75%;font-family:helvetica,sans-serif;text-align:left;} </style> <title>The URL you requested has been blocked</title></head> <body> <div class="oc"> <div class="ic"> <div class="msg" style="text-align: center"><img src=https://www.hku.hk/f/page/7561/basic_logo_20.jpg alt="The University of Hong Kong"></img><h1>The URL you requested has been blocked </h1><p>The webpage you have requested has been blocked, because the page was reported as containing phishing material. <br>Please refer to <a href="http://www.its.hku.hk/spam-report">HKU Spam report </a> or contact <a href="mailto:[email protected]">[email protected]</a> if you have further enquiry.<br /><br />URL = bit.ly/<br /></p></div></div></div></body></html> * Closing connection 0 Now, I am very curious about one thing: If I am able to establish a connection, (it says I am connected to the IP at the given port), how is the University coming in between? Is it some kind of firewall which sees: ` If (coming from bit.ly IP) => {Replace HTML with our- block page}`? This is my closest guess, since on HTTPS I get Invalid Certificate. Just wondering how it's happening, answers or even guesses would be appreciated.