I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. 

I was trying to access a `bit.ly` link, but it is blocked by my University. 

Knowing a bit of HTTP requests and basic network stuff, I initially suspected a DNS block. But even after changing to google DNS, I was getting the blocked page error. 

I used nslookup, both from my command line as well as a web utility, and got one of the servers as `67.199.248.10`. 

I used chrome to inspect the request, and indeed, the domain was being resolved to that IP. 

I even used curl on my local machine, and got this output:


    $ curl bit.ly -v
    * Rebuilt URL to: bit.ly/
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
      0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 67.199.248.10...
    * TCP_NODELAY set
    * Connected to bit.ly (67.199.248.10) port 80 (#0)
    > GET / HTTP/1.1
    > Host: bit.ly
    > User-Agent: curl/7.56.1
    > Accept: */*
    >
    < HTTP/1.1 403 Forbidden
    < Content-Type: text/html; charset="utf-8"
    < Content-Length: 1272
    < Connection: Close
    <
    { [1272 bytes data]
    100  1272  100  1272    0     0   1272      0  0:00:01 --:--:--  0:00:01  5412<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
    <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><style type="text/css">html,body{height:100%;padding:0;margin:0;}.oc{display:table;width:100%;height:100%;}.ic{display:table-cell;vertical-align:middle;height:100%;}div.msg{display:block;border:1px solid #30c;padding:0;width:500px;font-family:helvetica,sans-serif;margin:10px auto;}h1{font-weight:bold;color:#fff;font-size:14px;margin:0;padding:2px;text-align:center;background: #30c;}p{font-size:12px;margin:15px auto;width:75%;font-family:helvetica,sans-serif;text-align:left;}
    </style>
    
    <title>The URL you requested has been blocked</title></head>
    <body>
    
    <div class="oc">
    <div class="ic">
    
    <div class="msg" style="text-align: center"><img src=https://www.hku.hk/f/page/7561/basic_logo_20.jpg alt="The University of Hong Kong"></img><h1>The URL you requested has been blocked </h1><p>The webpage you have requested has been blocked, because the page was reported as containing phishing material.  <br>Please refer to <a href="http://www.its.hku.hk/spam-report">HKU Spam report </a> or contact <a href="mailto:[email protected]">[email protected]</a> if you have further enquiry.<br /><br />URL = bit.ly/<br /></p></div></div></div></body></html>
    
    * Closing connection 0

Now, I am very curious about one thing: If I am able to establish a connection, (it says I am connected to the IP at the given port), how is the University coming in between? Is it some kind of firewall which sees:

` If (coming from bit.ly IP) => {Replace HTML with our- block page}`? 

This is my closest guess, since on HTTPS I get Invalid Certificate. 
Just wondering how it's happening, answers or even guesses would be appreciated.