Question about behavior of blocking

[Quijib0]

Hello everyone,

I was testing a block list (don't recall the list right now) this morning and went to one of the urls on the list. I was promptly redirected to different level domain. I noticed, in the AGH log, that the base domain was indeed blocked.

My question: Is this expected behavior? Should redirects be allowed from blocked domains?

I'm trying to find a good malware blocklist that is maintained and am not finding any good sources.

I was a bit surprised that a blocked site was allowed to redirect by default. Just wondering if this is expected behavior, or not. Or, is it to do with the nature of subdomains? That would really suck because going through these lists and wild-carding everything would be quite a chore.

Thanks for any insight!

[ameshkov]

If a domain is blocked, you shouldn't be redirected anywhere. It'd be better if you could give us an example.

[Quijib0]

So the domain input was 000info.com

AGH shows that it was blocked. However, the log shows immediately after that www.000info.com being processed, followed by a slew of other completely different domains. I shut it down before anything could be downloaded or executed.

[ameshkov]

Hm, it may be that the browser on itself probes www. subdomain and since it was not blocked, goes further?

[Quijib0]

I don't recall any other subdomains in the log. Mostly it was other domains after that.

So, you're thinking that the browser (Firefox 78) is re-trying the connection by appending www? That would be really bad, if true.

[Quijib0]

So googling the appendage of www in Firefox, it seems that it is a 'thing'. Apparently the setting is called browser.fixup.alternate.prefix

Will have a look at this after work. Thanks for the help.