A few days ago people reported an anomaly when accessing the
whatismyip.com website. I did some troubleshooting and found out it was ICTA's Netsweeper filter that was telling Emtel & Mauritius Telecom (MyT) to route the request to their proxy server in Netherlands. I don't know what happens to the request on the Netherlands proxy server. What information they dig, what they save etc, before letting the request reach its final destination. ICTA never released any public notice informing Internet users of the presence of a proxy that filters non-CSA requests. Exceptionally on 4 May 2021, after it came light that ICTA has a BGP filter and proxy server already in production, then ICTA published an incident response from Netsweeper.
In the incident response, Netsweeper said that the request to
whatismyip.com was sent to the proxy in Netherlands because it shared the same IP addresses as another site which appeared on the Internet Watch Foundation's list of webpages containing Child Sexual Abuse content. Netsweeper reassured that incident was resolved.
However, today 6 May 2021, I opended
bing.com on a computer on my home network with a MyT connection and I notice that everything appeared in Dutch.
It was a Windows notebook, so I opened the Command Prompt and used the
tracert utility to check the network path to Microsoft Bing.
To my horror, the request to
www.bing.com was being proxied to ICTA's Netsweeper proxy in Netherlands. 😱
It sounds very unlikely to me that
bing.com is hosting any CSA content for the ICTA (Netsweeper) CSA filter to send my request to their proxy in Netherlands for further filtering.
I emailed Netsweeper & Mauritius Telecom to enquire about this. I'll update this post when I have more information.
- 7 May 2021 11h24
I received an update from the Mauritius Telecom "Network Team", informing that the issue has been resolved and
www.bing.comis now accessible directly from the nearest Microsoft cloud.
Below is my
traceroute to www.bing.com (184.108.40.206), 30 hops max, 60 byte packets 1 _gateway (192.168.100.1) 2.118 ms 6.633 ms 7.575 ms 2 220.127.116.11 (18.104.22.168) 7.803 ms 8.463 ms 9.082 ms 3 22.214.171.124 (126.96.36.199) 9.698 ms 10.484 ms 11.069 ms 4 188.8.131.52 (184.108.40.206) 48.087 ms 49.835 ms 49.219 ms 5 microsoft.ixp.joburg (220.127.116.11) 51.009 ms 51.611 ms 52.191 ms 6 ae21-0.icr01.jnb20.ntwk.msn.net (18.104.22.168) 50.312 ms 45.389 ms 45.438 ms 7 be-100-0.ibr01.jnb20.ntwk.msn.net (22.214.171.124) 294.618 ms 294.595 ms 294.576 ms 8 be-5-0.ibr01.mrs21.ntwk.msn.net (126.96.36.199) 294.556 ms 294.537 ms 294.518 ms 9 188.8.131.52 (184.108.40.206) 294.674 ms 261.101 ms 249.640 ms 10 be-8-0.ibr01.zrh20.ntwk.msn.net (220.127.116.11) 249.560 ms be-4-0.ibr01.zrh20.ntwk.msn.net (18.104.22.168) 249.514 ms be-8-0.ibr01.zrh20.ntwk.msn.net (22.214.171.124) 249.473 ms 11 be-5-0.ibr01.vie.ntwk.msn.net (126.96.36.199) 249.434 ms 249.393 ms 249.259 ms 12 ae36-0.vie-96cbe-1b.ntwk.msn.net (188.8.131.52) 249.036 ms ae24-0.vie-96cbe-1a.ntwk.msn.net (184.108.40.206) 247.677 ms ae36-0.vie-96cbe-1b.ntwk.msn.net (220.127.116.11) 247.578 ms
- I haven't received any update from Netweeper or ICTA on the incident yet.