ISP/DPI Blocking Detection
PingZen detects when a website is blocked by the Internet Service Provider (ISP) using Deep Packet Inspection (DPI) or DNS poisoning. Blocked sites are genuinely unavailable from Russia but may work from other countries. This is especially relevant for monitoring from Russia, where thousands of websites are filtered by ISPs.
What We Detect
TLS/Connection Errors
Connection reset during handshake, record layer failure, fake certificates — signs of DPI interference with encrypted connections.
Handshake Dropped by Site Name (SNI)
The TLS handshake gets no answer, or is cut, right after a ClientHello naming the site — the way TSPU blocks by SNI, and on its own it reads as a plain timeout. PingZen then runs a control handshake to the same IP without SNI and repeats it with the SNI: the block counts only when the server answers the first and drops the second again. A dead or overloaded server fails that test and is never flagged.
DNS Poisoning
Hostname resolves to a known ISP block page IP address instead of the real server.
HTTP Redirect to Block Page
ISP redirects the request to their block page (e.g., warning.rt.ru, blocked.mts.ru).
Block Page Content
Response body contains markers of ISP block pages (e.g., references to rkn.gov.ru, Roskomnadzor).
How It Looks in PingZen
- Affected checks read “Blocked by the internet provider”: in the monitors list (for a down monitor), in the per-probe rows and the check rows on the monitor page, and in the incident that the block opened. MCP tools say the same in their
Reason:andCause:lines. - A warning banner is shown on the monitor detail page with recommendations.
- Alert notifications include an ISP filtering warning with actionable advice.
Recommendations
- Switch to TCP or Ping protocol — these check port availability without HTTP content, bypassing most ISP filters.
- Disable SSL verification (verify_ssl=false) — avoids TLS handshake interference by DPI devices.
- Pause alerts for blocked monitors — prevents alert fatigue from expected blocking.
Supported ISP Detection
PingZen detects blocking by major Russian ISPs:
| ISP | Method |
|---|---|
| Rostelecom | DNS poisoning, block page redirect |
| MTS / MGTS | DNS poisoning, block page redirect |
| Beeline | DNS poisoning, block page |
| MegaFon | Redirect, fake certificate |
| Tele2 | DNS poisoning, block page redirect |
| Dom.ru (ER-Telecom) | DNS + DPI dual blocking |
| TTK | DNS poisoning, block page redirect |
| Yota | Block page redirect |
FAQ
Does PingZen suppress alerts for ISP-blocked sites?
No. PingZen annotates the check result with “ISP Filter” and enriches alert notifications with recommendations, but does not suppress alerts. You can pause alerts manually for specific monitors.
How accurate is ISP blocking detection?
Detection is based on 30+ known block page IPs, 20+ ISP redirect URLs, and 14+ content markers from OONI research. False positives are rare but possible for sites that legitimately use self-signed certificates.
Will this work for non-Russian ISPs?
Currently, the detection patterns are focused on Russian ISPs. The TLS error pattern detection may catch some DPI interference from other countries, but block page detection is Russia-specific.