Mauritius Requests to bing.com being proxied via ICTA's Internet filtering system in Netherlands

Today, I noticed that my request to www.bing.com was being proxied to a Netsweeper server in Netherlands. I reported it Netsweeper and kept ICTA in the loop.

Ish Sookun

Ish Sookun

3 min read

A few days ago people reported an anomaly when accessing the whatismyip.com website. I did some troubleshooting and found out it was ICTA's Netsweeper filter that was telling Emtel & Mauritius Telecom (MyT) to route the request to their proxy server in Netherlands. I don't know what happens to the request on the Netherlands proxy server. What information they dig, what they save etc, before letting the request reach its final destination. ICTA never released any public notice informing Internet users of the presence of a proxy that filters non-CSA requests. Exceptionally on 4 May 2021, after it came light that ICTA has a BGP filter and proxy server already in production, then ICTA published an incident response from Netsweeper.

In the incident response, Netsweeper said that the request to whatismyip.com was sent to the proxy in Netherlands because it shared the same IP addresses as another site which appeared on the Internet Watch Foundation's list of webpages containing Child Sexual Abuse content. Netsweeper reassured that incident was resolved.

However, today 6 May 2021, I opended bing.com on a computer on my home network with a MyT connection and I notice that everything appeared in Dutch.

Screenshot taken on Microsoft Edge / Windows 10
Screenshot taken on Microsoft Edge / Windows 10

It was a Windows notebook, so I opened the Command Prompt and used the tracert utility to check the network path to Microsoft Bing.

Network path traced on 6 May 2021 at 19:05 MUT
Network path traced on 6 May 2021 at 19:05 MUT

To my horror, the request to www.bing.com was being proxied to ICTA's Netsweeper proxy in Netherlands. 😱

It sounds very unlikely to me that bing.com is hosting any CSA content for the ICTA (Netsweeper) CSA filter to send my request to their proxy in Netherlands for further filtering.

I emailed Netsweeper & Mauritius Telecom to enquire about this. I'll update this post when I have more information.

Update

  • 7 May 2021 11h24
    I received an update from the Mauritius Telecom "Network Team", informing that the issue has been resolved and www.bing.com is now accessible directly from the nearest Microsoft cloud.

    Below is my traceroute result.
traceroute to www.bing.com (131.253.33.200), 30 hops max, 60 byte packets
 1  _gateway (192.168.100.1)  2.118 ms  6.633 ms  7.575 ms
 2  196.20.220.1 (196.20.220.1)  7.803 ms  8.463 ms  9.082 ms
 3  196.192.102.166 (196.192.102.166)  9.698 ms  10.484 ms  11.069 ms
 4  197.226.230.12 (197.226.230.12)  48.087 ms  49.835 ms  49.219 ms
 5  microsoft.ixp.joburg (196.60.8.133)  51.009 ms  51.611 ms  52.191 ms
 6  ae21-0.icr01.jnb20.ntwk.msn.net (104.44.237.225)  50.312 ms  45.389 ms  45.438 ms
 7  be-100-0.ibr01.jnb20.ntwk.msn.net (104.44.20.65)  294.618 ms  294.595 ms  294.576 ms
 8  be-5-0.ibr01.mrs21.ntwk.msn.net (104.44.30.32)  294.556 ms  294.537 ms  294.518 ms
 9  104.44.29.69 (104.44.29.69)  294.674 ms  261.101 ms  249.640 ms
10  be-8-0.ibr01.zrh20.ntwk.msn.net (104.44.19.34)  249.560 ms be-4-0.ibr01.zrh20.ntwk.msn.net (104.44.18.50)  249.514 ms be-8-0.ibr01.zrh20.ntwk.msn.net (104.44.19.34)  249.473 ms
11  be-5-0.ibr01.vie.ntwk.msn.net (104.44.19.7)  249.434 ms  249.393 ms  249.259 ms
12  ae36-0.vie-96cbe-1b.ntwk.msn.net (104.44.21.232)  249.036 ms ae24-0.vie-96cbe-1a.ntwk.msn.net (104.44.20.84)  247.677 ms ae36-0.vie-96cbe-1b.ntwk.msn.net (104.44.21.232)  247.578 ms
  • I haven't received any update from Netweeper or ICTA on the incident yet.