$> resolvectl query torproject.org torproject.org: 146.112.61.106
-- Information acquired via protocol DNS in 56.6ms. -- Data is authenticated: no
Calling this IP will yield a website that loads a JS snippet replacing the URL. $> curl 146.112.61.106 <html><head><script type="text/javascript">location.replace("https://block.opendns.com/?url=1821231518181915231815181723&ablock&server=ams16&prefs=&tagging=&nref");</script></head></html>
IMHO DNS-service-providers, especially 3rd-party ones ought to be impartial. I know the arguments, but it does not readicate the problem(this may vary depending on what example you are leading with), and TBH I rather not be protected from "the big bad internet" as if I am "Little Red Riding Hood" and the Internet "The Big Bad Wolf". I am a grown human being with full command over my faculties. Besides, I wonder what the excuse is for blocking bbs.archlinux.org(did MS or Google or Disney(fearing the "security" for their content on Plus) complain and is it not enough that their DRM prevents watching content on Linux), torproject.org(hmmm too easy constructing s.th.), and of course stackexchange is ground zero for all evil things.
I for one find it sad that OpenDNS is doing this under the aegis of Cisco. One could say that they are following a notice for the tracker, BUT torproject, stackexchange and bbs.archlinux.org?
Maybe some people more familiar with this matter can enlighten me. All the SSL-certificates are only valid for ~7days. Why such a short time? Also note that the SSL-Certificate is self-signed, by Cisco and since they are allowed to sign, it is automatically valid. Only reason this raised flags was certificate-pinning.
Happy Holidays folks! :D