How to identify an ISP-level or government-level block

A failed webpage is not automatically a censored webpage. The error can come from DNS resolution, an unreachable route, TLS negotiation, server-side geographic rules, malware filtering, or local security software. In Australia, one hostname may fail on Telstra broadband in Sydney but load on Optus mobile in Melbourne because resolvers, middleboxes and upstream routes differ. The useful diagnosis identifies the layer first, then asks whether the intervention is at the ISP level or government level.

Net Neutrality Monitor is a web-based project for comparing observations. The beta, volunteer-supported project is developed and powered by AirVPN. It tracks filtering by Internet Service Providers (ISPs) and DNS servers and publishes country reports for blocked websites and addresses across multiple countries, alongside blacklist, probe, DNS and statistical data. Users can submit a URL or IP address for monitoring. An observation shows what happened at a place and time; it does not alone identify who issued an order.

A practical diagnostic split

An ISP-level intervention operates inside an access provider's network. It may be a security policy, reseller setting, Server Name Indication (SNI) filter, or a block delivered under a legal direction. Government-directed filtering begins with a public authority, regulation or court and may reach one ISP or the whole market. A single-provider failure does not prove government involvement; a multi-provider pattern needs independent corroboration.

Signal	ISP-level explanation	Government-directed explanation
One Australian provider fails while another loads the resource	Resolver, middlebox, route or commercial policy	Narrow order or configuration affecting one provider
Several unrelated Australian providers fail while an unaffected foreign path loads	Shared filtering or upstream policy	Consistent implementation of a national order
DNS resolves, but HTTP or TLS is rejected	SNI inspection or security appliance	Ordered domain or IP filtering across providers
An official notice names the service	Corroboration, with local implementation	Administrative evidence for a directed block

Attribution must separate mechanism from authority: an ISP-level mechanism can execute a government order. Treat the signals as likelihoods; an order can target one provider, an ISP can overblock a shared address, and a provider can filter without an order. A public decision may not yet be implemented everywhere.

Start with the exact failing resource

Record the complete URL, subdomain, path, port, timestamp, Australian city, connection type, ISP, resolver and whether the test used IPv4 or IPv6. Test the same resource rather than a search-result redirect; content delivery networks (CDNs) and certificates can change the target. Keep the exact failure—timeout, refusal, DNS error, TLS error or HTTP status—because each indicates a different layer.

Repeat the check from a second connection that does not share the same router, such as another fixed-line provider or mobile network. A laptop, browser extension or parental-control service can imitate a network block. If the resource works elsewhere, compare its address and server response before calling it censorship.

Compare DNS, TLS and network paths

Begin with DNS. Compare the system resolver with an independent encrypted resolver, then compare A and AAAA answers with results outside Australia. A resolver that refuses or changes an answer while another returns a usable address suggests DNS filtering; regional differences can be CDN geolocation. Record NXDOMAIN, SERVFAIL and timeouts separately.

If DNS succeeds, check TCP reachability, TLS certificates and the requested host. Failure before TLS suggests routing or middlebox interference; a reachable origin returning 403, 451 or a login page more often reflects an application or geographic rule. Direct-IP tests are valid only when supported and authorised, since certificate mismatches can look like blocking.

For an Australian test, a public Australian casino analysis can be a stable betting-related reference. Compare that exact page across an Australian ISP, mobile network and unaffected path, recording whether failure follows the domain, a CDN address or a state-facing service; the article's subject is not the evidence.

Read Australian policy and market context

Australian filtering has several legal scopes. The federal Australian Communications and Media Authority (ACMA) can issue website-blocking directions under telecommunications law, while state gambling commissions and federal rules govern different parts of online betting and casino regulation. A failure may reflect licensing, geo-restriction or ISP policy rather than a national content ban. Telstra, Optus, TPG, iiNet and resellers can apply different controls.

Cleanfeed, the industry-funded Australian child-safety blocking initiative, shows why implementation matters. A block associated with participating ISPs can be operationally distinct from a direct government order, even within a shared legal framework. Compare the target with ACMA, court and industry notices, and test in Sydney, Brisbane and Perth. A reseller may inherit an upstream block.

A cross-border reference such as Serbian nonprofit registration adds perspective: availability in Australia but failure from Serbian connections suggests a country-specific condition. Failure across several Australian providers calls for resolver, route and notice checks.

Use DNS and address clues carefully

Shared hosting changes the meaning of an IP result. Dynamic IP hosting describes addresses that move or serve multiple domains; CDNs and anycast networks can also send Australian users to different edges. If a hostname reaches a new address and works, the earlier failure may be address-specific, not a domain ban. Compare IPv4 and IPv6 addresses, their autonomous system (ASN) and reverse DNS.

Use multiple vantage points. Net Neutrality Monitor probes and DNS records can show whether failures cluster around one provider, address range or country. Packet loss on one Australian ISP is consistent with ISP-level filtering or routing trouble; repeated drops across unrelated ASNs and resolvers suggest shared policy, while transit, cyberattack defence and peering remain alternatives.

Distinguish policy from collateral effects

A government-directed block may target a domain, IP address, DNS response or encrypted-protocol metadata. An ISP can apply it too broadly, causing collateral effects: a shared host loses unrelated services, a CDN edge seems unreachable, or an entire ASN is affected by one address allocation. These reveal scope, not the decision-maker by themselves.

Separate policy from collateral failure. Malware filtering, adult-content controls, parental controls and Cleanfeed can block a page in Australia, while a server may deny requests because of authentication, rate limits or