Three causes look the same to the customer: the site is down for everyone, a provider or its filter blocks it for that provider's customers, or your own bot protection or geo rule turns that network away. Get the provider and the connection type first.
Is the site down for everyone, or only on one provider?
Look at your uptime monitor first: if it fails too, the site is down for everyone. If the monitor is green and the complaints come from one provider's customers, or only on mobile data, the cause sits on that network or in a rule of yours that treats it differently. Neither a datacenter monitor nor a test from your office uses the customer's network (why datacenter monitors miss ISP blocks).
What should you ask the customer?
Ask for the provider (Telekom, Orange, Plus), home internet or mobile data, the exact address, the time and a screenshot. What the browser showed often points to who stopped the page:
- A provider's notice or warning page: a block list or the provider's own filter. Ask whether a security or family filter is on in the account.
- A certificate error: can mean the provider's DNS (the internet's address book) sent visitors of your https (encrypted) site to another server. Orange Polska sends blocked visitors to its own servers, which present Orange's certificate, not yours. In our own measurements in Germany in November 2026, a visitor sent to a notice server over https usually saw a browser security error, not the notice.
- "This site can't be reached": DNS or the network stopped the request before your server.
- A challenge or "access denied" page: if it comes from your CDN (the shared network your site sits behind, such as Cloudflare), usually your own rules, or a legal block in front of your site (see HTTP 451).
Is your own bot protection turning these customers away?
Your logs answer that: if the customer's requests arrived and got an "access denied" (403), "too many requests" (429) or a challenge, your own rule stopped them. Many mobile networks use carrier-grade NAT, where many subscribers share one public address, so a rule that counts by address treats them as one visitor. Cloudflare measured in 2025 that such addresses were rate limited three times more often than others, although their bot scores suggested human visitors. More causes: works on Wi-Fi, not on mobile data.
Sources: IETF RFC 6269, June 2011 · Cloudflare blog, 29 October 2025
Who can lift a wrong block?
Whoever put the domain on the list, often not the provider the customer pays; say so in your reply.
- Germany, CUII. Telekom, Vodafone, O2 and 1&1 apply its blocks, and their support cannot lift them. The domain owner uses the form on cuii.info with the sender type "Domaininhaber" (domain owner), mentioning it if the block predates their ownership; the CUII promises an acknowledgement of receipt within a week (Telekom, Vodafone).CUII, contact, checked 11 November 2026 · heise online, 16 July 2025
- Poland, CERT Polska's phishing list. Applied by Orange, Play, Plus and T-Mobile. The domain holder objects to the head of UKE, the telecom regulator, with a qualified electronic signature or a Polish e-ID, not a plain email; UKE decides within 14 days.
- Orange's own filter. Enter the domain in Orange's domain checker. If Orange blocks it and it is on no national list, Orange asks for reports to cert.opl@orange.com (Orange).
- Paid security add-ons. Plus, Play and Netia publish no route for site owners. With Play and Netia, the customer who has the filter can report the block to customer service. Plus's and Netia's filters run on F-Secure technology, and F-Secure's sample form accepts a URL reported as a harmless page that is blocked; neither Plus nor Netia says whether a fix there reaches its filter (Plus, Play).Plus · Play terms, 25 November 2021 · Netia · Telepolis, 22 August 2025 · F-Secure, submit a sample, checked 11 November 2026
- Norway, Telenor's Nettvern. The filter is on automatically for Telenor's private mobile and broadband customers. For a wrong block, Telenor points to its customer service (Telenor).Telenor, Nettvern · Telenor, net neutrality, checked 11 November 2026
What should an agency watch on each client's site?
Watch the pages that earn money or let people in (home, login, checkout, ad landing pages) in each country where the client sells, on home and mobile. A 2020 CERT Polska FAQ named a site taken over by criminals as one way an honest site gets blocked, and said .pl domain owners got no warning before a block. A CUII block can outlast the site it was meant for, so a domain bought second-hand can arrive blocked. After you change a client's CDN, hosting or bot rules, check the provider networks again.
Sources: CERT Polska FAQ, 23 March 2020 (historical) · netzpolitik.org, 12 September 2024
What linkspect answers on a ticket
The free check on this site takes one URL in one of the open countries, behind a captcha, a few checks per hour. Through the API, a check can be narrowed to the customer's provider and to home or mobile, and the answer explains in plain English or Russian what stopped the page, or that nothing did. If our own test connection fails, the answer says so and does not count it as a block. For agencies, monitors re-check each client's key pages every 15 minutes to 24 hours (20 per account by default) and send each change a re-check confirms to your own server as a signed webhook, which you can forward to your ticketing system. Early access is free; keys are handed out by hand.
| Plusmobile | Site refused us target_policyYour own bot protection showed our test a "prove you are human" check. Not a block by Plus. |
| Orangehome | Blocked dns.redirectOrange's DNS sends shop.example to its warning server, so a visitor's browser shows a certificate error. Seen on 3 Orange customers' connections in 2 parts of its network; marked "likely". |