List of copyright-related DNS blocks in Germany (CUII Lists) #387
Comments
|
Does anyone know what one of the DNS blocks looks like? Is the returned IP address one of the ISP's own, an IP address shared by all member ISPs, or a useless one like 127.0.0.1? Do you get 2 DNS responses (the one containing the block address and a real one) or just 1 (the one containing a block address). In other words, is it DNS response injection, or did the ISPs program their own resolvers to respond differently to queries for certain names? The provided circumvention instructions seem to recommend just turning on DNS over HTTPS. |
|
Except for things like captive portals, most DNS blocks in central and western europe are performed without any response injection. It's not just DoH that can bypass those (mostly copyright-related) restrictions but any change in DNS servers at all. In Germany specifically, ISPs face a surprising amount of liability for individual cases of copyright infringement or any misbehavior of their users. I am not sure if that might explain their behavior in the case of website blocking. |
wkrp
changed the title
|
hey, owner of cuiiliste.de here interestingly enough, we observed that the biggest german ISP, Telekom, recently stopped returning that CNAME and now just returns NXDOMAIN. try it yourself: info: the DNS resolver in the screenshot can only be accessed if 1&1 is your ISP. |
hey, it's an original list from the cuii, i have no clue why they're doing it like that. since the cuii isn't blocking wildcard records, but instead are blocking all subdomains manually, we decided to include the www3 and other subdomains. |
Great, thanks for that information. With this, I was able to find examples of such DNS blocks in OONI explorer, like this one in Deutsche Telekom. It seems OONI doesn't record the CNAME record, but it does have the A record of 167.233.14.14. As expected, it leads to an eventual ssl_invalid_hostname error as the notice.cuii.info server doesn't have a certificate for sci-hub.se. https://explorer.ooni.org/m/20240819220406.466321_DE_webconnectivity_1e0e3b6a896d55ff Looking at the past month of measurements, about half are showing as Anomaly.
|
The site https://cuiiliste.de/ claims to catalog a list of domain names blocked by DNS by certain ISPs in Germany at the behest of CUII (Clearingstelle Urheberrecht im Internet / Clearing Body for Copyright on the Internet). My understanding is that these domains are not blocked by law; rather CUII is an independent organization with which some ISPs have a private agreement (archive, English, English archive).
The methodology of obtaining the list is unclear. CUII publishes a list of its blocking recommendations, but the list is only website names or base domains, not the kind of list an ISP would need to implement the block technically. German Wikipedia says the source of the list of domains is a "leak" (with more discussion at the talk page). A TorrentFreak article (archive) implies it was created through trial DNS resolutions:
The CUII FAQ and Code of Conduct (1(b)) says the only technical means of blocking used is DNS blocking, so trial DNS resolution should be sufficient as a test. The self-test on the website actually just looks up the ASN of the web browser client and checks it against a list of known-affected ASNs.
There's a paginated search interface at https://cuiiliste.de/domains, but there is also a JSON API that is probably more convenient.
https://api.cuiiliste.de/blocked_domains
api.cuiiliste.de_blocked_domains_20240823.json
Tabular list of domains from /blocked_domains API
astrotheque.netwww.astrotheque.netbs.towww.bs.tobuffsports.mewww.buffsports.mebuffstreams.sxwww.buffstreams.sxburningseries.acwww.burningseries.acwww.burningseries.cowww.burningseries.sxburningseries.twwww.burningseries.twwww.burningseries.vccanna-power.tocanna.touu.canna.tocine.towww.cine.tofilmfans.orgwww.filmfans.orgfilmpalast.towww.filmpalast.toharleyquinnwidget.comharleyquinnwidget.liveharleyquinnwidget.netwww.harleyquinnwidget.comisrabox.comisrabox-music.comisrabox-music.orgisrbx.comisrbx.meisrbx.netamerican-football.jokerguide.comathletics.jokerguide.comaussie-rules.jokerguide.combadminton.jokerguide.combasketball1.jokerguide.combasketball.jokerguide.combeach-volley.jokerguide.comboxing1.jokerguide.comcycling.jokerguide.comdarts1.jokerguide.comf1.jokerguide.comfootball1.jokerguide.comfutsal.jokerguide.comgolf.jokerguide.comhandball.jokerguide.comice-hockey.jokerguide.comjokerguide.commlb1.jokerguide.commotorsport.jokerguide.comnba3.jokerguide.comnba.jokerguide.comncaab1.jokerguide.comncaaf.jokerguide.comnfl2.jokerguide.comnfl.jokerguide.comnhl4.jokerguide.comreddit.jokerguide.comrugby2.jokerguide.comsnooker2.jokerguide.comtable-tennis.jokerguide.comtennis.jokerguide.comufc1.jokerguide.comvolleyball2.jokerguide.comwaterpolo.jokerguide.comwww.jokerguide.comjokerlivestream.netjokerlivestream.orgwww.jokerlivestream.orgjokerlivestream.vipwww.jokerlivestream.vipkinos.toww4.kinos.toww15.kinos.toww17.kinos.toww19.kinos.towww8.kinos.towww12.kinos.towww13.kinos.towww14.kinos.towww15.kinos.towww17.kinos.towww.kinos.towww.kinox.amwww.kinox.bzwww.kinox.clickwww3.kinox.clickwww3.kinox.cloudwww.kinox.cloudwww.kinox.clubkinox.digitalwww.kinox.digitalwww3.kinox.digitalkinox.directwww.kinox.directkinox.expresswww.kinox.expresswww3.kinox.expresskinox.funwww.kinox.funwww3.kinox.funwww3.kinox.fyiwww.kinox.fyikinox.gratiswww.kinox.gratiswww3.kinox.gratiskinox.iowww.kinox.iowww3.kinox.iokinox.lolwww.kinox.lolwww3.kinox.lolkinox.mewww.kinox.mewww3.kinox.mekinox.mobiwww.kinox.mobiwww3.kinox.mobikinox.pubwww.kinox.pubwww3.kinox.pubwww3.kinox.shwww.kinox.shwww.kinox.spacekinox.sxwww.kinox.sxwww3.kinox.sxkinox.toww4.kinox.toww7.kinox.toww8.kinox.toww11.kinox.toww15.kinox.toww16.kinox.toww17.kinox.toww18.kinox.toww19.kinox.towww1.kinox.towww2.kinox.towww4.kinox.towww5.kinox.towww6.kinox.towww7.kinox.towww8.kinox.towww9.kinox.towww12.kinox.towww13.kinox.towww15.kinox.towww16.kinox.towww17.kinox.towww18.kinox.towww.kinox.towww.kinox.tubekinox.tvwww.kinox.tvwww3.kinox.tvkinox.wtfwww.kinox.wtfwww.kinoz.cokinoz.toww14.kinoz.toww15.kinoz.toww17.kinoz.toww18.kinoz.toww19.kinoz.towww3.kinoz.towww4.kinoz.towww5.kinoz.towww8.kinoz.towww12.kinoz.towww13.kinoz.towww14.kinoz.towww15.kinoz.towww16.kinoz.towww17.kinoz.towww18.kinoz.towww.kinoz.tomegakino.bizwww.megakino.bizmegakino.cabwww.megakino.cabmegakino.cowww.megakino.comegakino.inkwww.megakino.inkmegakino.menwww.megakino.menmegakino.vinwww.megakino.vinmegakino.wswww.megakino.wsnewalbumreleases.netnewerastreams.comwww.newerastreams.comnsw2u.comwww.nsw2u.comnsw2u.innsw2u.netwww.nsw2u.netwww.nsw2u.orgnsw2u.xyznswgame.comwww.nswgame.comromslab.comwww.romslab.comsci-hub.ruwww.sci-hub.rusci-hub.sewww.sci-hub.sesci-hub.stwww.sci-hub.stserienfans.orgwww.serienfans.orgserienjunkies.bizwww.serienjunkies.bizserienjunkies.euwww.serienjunkies.euserienjunkies.infowww.serienjunkies.infoserienjunkies.orgnew.serienjunkies.orgwww.serienjunkies.orgserienjunkies.uswww.serienjunkies.usserienstream.towww.serienstream.toserien.sxs.towww.s.tostreamkiste.clubstreamkiste.funstreamkiste.mestreamkiste.netstreamkiste.prostreamkiste.pwstreamkiste.sitestreamkiste.spacestreamkiste.tvwww.streamkiste.tvtaodung.comtazz.tvtennis.streamkinox.unblockit.blackkinox.unblockit.daykinox.unblockit.llckinox.unblockit.movkinox.unblockit.ongnewalbumreleases.unblocked.conewalbumreleases.unblockit.appnewalbumreleases.unblockit.betnewalbumreleases.unblockit.bluenewalbumreleases.unblockit.buzznewalbumreleases.unblockit.camnewalbumreleases.unblockit.catnewalbumreleases.unblockit.chnewalbumreleases.unblockit.clubnewalbumreleases.unblockit.daynewalbumreleases.unblockit.devnewalbumreleases.unblockit.hownewalbumreleases.unblockit.inknewalbumreleases.unblockit.istnewalbumreleases.unblockit.kimnewalbumreleases.unblockit.linewalbumreleases.unblockit.linknewalbumreleases.unblockit.ltdnewalbumreleases.unblockit.menewalbumreleases.unblockit.namenewalbumreleases.unblockit.nznewalbumreleases.unblockit.onlnewalbumreleases.unblockit.unoziperto.comwww.ziperto.comThe list is a bit strange: for example, it contains
www1.kinox.to,www2.kinox.to, andwww4.kinox.to, but notwww3.kinox.to.The text was updated successfully, but these errors were encountered: