dweb.link is a public gateway to IPFS, a network that stores files under a fingerprint of their content, called a CID. A site or app can link to such a file through it, with an address like <CID>.ipfs.dweb.link. In our check on 12 November 2026, Orange Polska's DNS (the internet's address book, which turns a name into a server address) sent dweb.link to Orange's own warning page on 3 of 3 home and 3 of 3 mobile lines. It did the same with an address under dweb.link that is not on CERT Polska's warning list: the IPFS documentation. An earlier check that morning saw the warning page on 4 of 5 Orange home lines, with one line opening the site. T-Mobile, Play, Plus and Netia let both addresses through. OONI, an open project that measures internet censorship, first confirmed the block on Orange on 28 February 2026.
Sources: OONI measurement, Orange, 28 February 2026 · OONI measurement, Orange, 9 November 2026 · our checks, 12 November 2026
What our checks saw on 12 November 2026
We opened seven gateway addresses through home and mobile lines of Polish providers, usually three to five lines per provider and connection type. Each line is a different customer's connection.
| Address | Orange, home and mobile | Play, home and mobile | T-Mobile, Plus, Netia |
|---|---|---|---|
| dweb.link | Orange's warning page, 3 of 3 lines each | Opened | Opened |
| The IPFS documentation (docs.ipfs.tech) at bafybeier6…xzvm.ipfs.dweb.link, not on CERT Polska's list | Orange's warning page, 3 of 3 lines each | Reached the gateway | Reached the gateway |
| A phishing page under ipfs.dweb.link, on CERT Polska's list since 2 June 2026 | Orange's warning page | CERT Polska's warning page | Blocked: T-Mobile's warning page; CERT Polska's at Plus and Netia |
| The same documentation under ipfs.inbrowser.link | Opened | Opened | Opened |
| ipfs.io | Opened | Opened | Opened |
| w3s.link, another public gateway | Opened | Play's warning page, 3 of 3 lines each | Opened |
| The same documentation under ipfs.w3s.link | Opened | Opened | Opened (T-Mobile home: 1 line only) |
- It is Orange's DNS. Orange home connections that used Google's public DNS instead of Orange's reached dweb.link and the documentation. Our own control server outside Poland loaded dweb.link too.
- Lines can disagree. In the morning check, Orange's DNS did not send dweb.link to the warning page on one of the five home lines, and our check found nothing that explains the difference. OONI also has one Orange measurement, on 11 November, in which dweb.link opened.
- "Reached the gateway". Addresses under dweb.link and ipfs.dweb.link now turn away automated clients such as our check with an HTTP 429 refusal (see below). What counts here is that the name led to the gateway, not to a warning page.
- Limits. Our results are not yet calibrated, and a DNS block is marked at most "likely". Vectra and INEA were not measured.
OONI's picture matches. Between 1 August and 12 November 2026, 14 of its 22 measurements of dweb.link from Orange's network were confirmed blocks; on other Polish networks it confirmed none. Its measurements on Orange from October 2025 to 26 February 2026 opened the site.
Sources: OONI, dweb.link in Poland by network, 1 August to 12 November 2026 · OONI measurement, Orange, 11 November 2026 · Play's warning page, opened 12 November 2026
Is this CERT Polska's list?
Not for the whole domain. On 12 November 2026, the warning list of CERT Polska, Poland's national computer security team, held 11 addresses of the form <CID>.ipfs.dweb.link and 64 under ipfs.inbrowser.link: single phishing pages stored on IPFS. It does not list dweb.link, inbrowser.link, ipfs.io or w3s.link. CERT Polska tells providers to block a listed name and the longer names built on it, not the shorter name above it. All five providers we measured blocked the listed phishing page, including Netia, which is not among the four providers that signed the 2020 agreement to apply the list. Only Orange blocked dweb.link itself and the documentation.
Orange runs its own filter, CyberTarcza ("cyber shield"), which changes the answers of Orange's DNS for blocked domains. Our reading, not confirmed by Orange, is that the dweb.link block comes from that filter. Play's block of w3s.link does not come from the list either: Play's DNS points the name to blokada.play.pl, Play's own page, which says "Wykryliśmy zagrożenie" ("we detected a threat").
Sources: CERT Polska warning list, downloaded 12 November 2026 · CERT Polska, warning list rules, updated 2 September 2026 · CERT Orange Polska, CyberTarcza facts and myths, updated 3 July 2026
dweb.link now hands browsers on to inbrowser.link
In August 2026 the IPFS Foundation said that browsers opening ipfs.io or dweb.link are redirected to inbrowser.link, a gateway that runs inside the browser and fetches files directly from the IPFS network, and that the old gateways now limit hotlinked and backend traffic. On 12 November 2026 dweb.link did exactly that: a request with a browser's headers got a redirect to the same address on inbrowser.link, and a plain script got the 429 refusal. An Orange customer never sees the redirect, because Orange's DNS answers first, with the warning page.
Sources: IPFS Foundation, IPFS is moving beyond the sponsored gateways, 25 August 2026 · IPFS, gateway changes notice, opened 12 November 2026
What it means for site owners
- Expect links through dweb.link to fail on Orange. In our check, an address under dweb.link that is not on CERT Polska's list went to Orange's warning page, at home and on mobile, so expect the same for yours. If your whole site lives at <CID>.ipfs.dweb.link, Orange customers in Poland who open it are likely to get Orange's warning page instead, and images, metadata or documents your pages load from dweb.link are likely not to load at all. Over https (the padlock in the browser) visitors see a certificate warning first: on Orange's mobile lines, our check got the warning page's certificate instead of the gateway's.
- inbrowser.link opened. For links that people open in the browser, the IPFS documentation tells sites to switch from ipfs.io to inbrowser.link, to skip the redirect. For Orange customers the switch matters more: in our check, the documentation under inbrowser.link opened on Orange's home and mobile lines. For images and other files your pages load, the same documentation recommends running your own gateway; on your own domain, it also removes the dependence on someone else's name.
- w3s.link links may fail on Play. In our check, Play's DNS sent the name w3s.link itself to Play's warning page on 3 of 3 home and 3 of 3 mobile lines. A DNS block covers every address on that name, so links of the form w3s.link/ipfs/<CID> should fail on Play too; we did not test such a link separately. Addresses of the form <CID>.ipfs.w3s.link opened.
- Public filtering DNS blocks more. Queried from our own servers on 12 November 2026, DNS4EU's protective, child and ad-blocking modes sent dweb.link, the documentation under both dweb.link and inbrowser.link, and w3s.link to a block page.
- If you think a block is wrong. Orange's domain checker shows whether a domain is blocked on Orange's network, and CERT Orange Polska takes reports of wrong blocks at cert.opl@orange.com.
Sources: IPFS Docs, Replace public gateways with self-hosted IPFS · CERT Orange Polska, updated 3 July 2026 · our checks, 12 November 2026
When your content sits under someone else's domain, a filter that judges that domain judges your content with it. Check the names your site depends on, through the providers your visitors use, not only your own domain.
How blocking works in Poland · Collateral blocking in Europe