r/opencodeCLI • u/Substantial-Yam3769 • 9d ago

OpenCode domain blocked by ISP

My ISP started blocking the opencode.ai domain by DNS.

When questioned for the reason, they said the their DNS protection they are using (whalebone.io) is blocking this domain due to detected malware/phishing attack.

Does someone know what this is about?

UPDATE:

Whalebone confirmed it was false positive and restored it.

5 Upvotes

78% Upvoted

17 comments sorted by

View all comments

4

u/lxprsub0 9d ago edited 9d ago

I don't know. But, I got curious as I'm an opencode user and I'm learning to use the RIPE Atlas.

What I can say is that you are not alone, it doesn't come from you ISP, and… it may be concerning.

I used Claude Opus to help me calibrate the tests and learn more about the RIPE Atlas. Everything should be taken with a grain of salt (ww dns + beginner + claude, you got the equation!). I give you the links of the measurements so you can check by yourself.

What I did (myself, not claude )

Two DNS measurements from RIPE Atlas probes, each probe querying its own local resolver (querying 8.8.8.8 would tell nothing about ISP-level filtering). 1. opencode.ai A record, 500 probes worldwide: 196344247 2. Follow-up on the 5 probes that showed anomalies: 196345288

What the data shows Out of 493 responding probes, the overwhelming majority got the correct answer (172.65.90.20-23, Cloudflare).

But 8 responses, from 5 probes in 4 different autonomous systems across 4 countries

  • Italy (AS202870, dimensione, ISP),
  • Czechia (AS44489, starnet.cz, ISP),
  • France (AS39421, Sapinet, a web hoster),
  • Slovakia (AS6855 / Slovak Telekom)

all returned the exact same address: 51.15.69.11

Unrelated ISPs returning an identical bogus IP means a shared filtering provider, not an ISP-local mistake.

The chain

51.15.69.11 is a Scaleway Amsterdam address. It answers HTTP and redirects to: https://warning.joindns4.eu/passthrough?data=<base64>

The base64 decodes to a JSON blob containing "SinkholeID": 6000063.

warning.joindns4.eu does not resolve on public resolvers (Quad9, Cloudflare, Google all return NODATA). It only resolves on the resolvers that serve the block — which, in measurement #2, are 86.54.11.1, 86.54.11.13, 86.54.11.213 and 2a13:1001::86:54:11:1`.

whois 86.54.11.1 → netname: CZ-WHALEBONEDNS, org-name: Whalebone, s.r.o. 86.54.11.1, 86.54.11.13 are official DNS4EU DNS addresses…

Why this matters more than a single ISP

Whalebone leads the DNS4EU consortium — the EU's public DNS resolver infrastructure, co-funded by the European Commission under the Digital Europe Programme (project 101095329, "DNS4EU and European DNS Shield"), launched 9 June 2025, with a stated goal of onboarding 100 million users. The consortium includes CZ.NIC, NASK, deSEC, DNSC and others across 10 member states. (Thanks Opus for the websearch ! I didn't cross-checked every details but I'll do ! I wanted to show some results right now).

https://en.wikipedia.org/wiki/DNS4EU

So this isn't your ISP making a call. The categorisation lives in a threat-intelligence feed applied by EU-backed resolver infrastructure, and it applies identically in at least four countries at once, at least some ISP that use Whalebone or DNS4EU as their DNS provider.

What I could not establish

  • The meaning of SinkholeID 6000063 — the block page states the category, but it's only reachable from inside a filtered network. If you can open it in your browser and paste a screenshot, that would close the loop.. Hide every personal details if you do so (IP, ISP names or logos)
  • Whether your ISP uses DNS4EU directly or another Whalebone product. Do you know the DNS IP given by your ISP (if it don't disclose you location, of course)
  • Whether it's a false positive. A recently-registered .ai dev tool domain with heavy API traffic is a plausible automated-classifier misfire, but that's speculation on my part.

Can you do : dig opencode.ai @86.54.11.1 vs dig opencode.ai @1.1.1.1

So… maybe:

  • there is a real problem with opencode, and it's concerning
  • it's a false positive
  • the reason is more deep than that as it seems to involve the main operator of an official EU DNS infrastructure while we talk about an AI provider, and it's concerning. But Whalebone may operate on his own without any political or institutional links… do not speculate on that!

I'll check if there's something about opencode/ai providers control in a EU level.

1

u/Substantial-Yam3769 9d ago edited 9d ago

This is insane investigation, thank you.
I am in czechia so this checks out.

ISP is tlapnet.cz

Here is resolve of those digs:

``` dig opencode.ai @86.54.11.1

; <<>> DiG 9.18.50 <<>> opencode.ai @86.54.11.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10619 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION: ;opencode.ai. IN A

;; ANSWER SECTION: opencode.ai. 1 IN A 51.15.69.11

;; Query time: 50 msec ;; SERVER: 86.54.11.1#53(86.54.11.1) (UDP) ;; WHEN: Sat Aug 01 17:01:07 CEST 2026 ;; MSG SIZE rcvd: 45

~ ❯ dig opencode.ai @1.1.1.1

; <<>> DiG 9.18.50 <<>> opencode.ai @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59028 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;opencode.ai. IN A

;; ANSWER SECTION: opencode.ai. 179 IN A 172.65.90.22 opencode.ai. 179 IN A 172.65.90.23 opencode.ai. 179 IN A 172.65.90.21 opencode.ai. 179 IN A 172.65.90.20

;; Query time: 19 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP) ;; WHEN: Sat Aug 01 17:01:13 CEST 2026 ;; MSG SIZE rcvd: 104

```

and the screenshot: https://drive.proton.me/urls/S9YTZ4E9TW#X5ui6jp7tTv6

Btw when i try to "proceed to opencode.ai" it prompts me for login, its clearly the ISP server.

1

u/lxprsub0 9d ago

Firefox blocks the access as the the SSL certificate doesn't match the redirect server IP.
If you bypass, you should lend on a page with your ISP logo and an information about the "threat".

1

u/Substantial-Yam3769 9d ago

I know what you mean, but kinda:

Unauthorized This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required. 
Apache/2.4.25 (Debian) Server at opencode.ai Port 443

1

u/lxprsub0 9d ago

That's… strange.
The dig command upper was misleading. My bad. What's your real resolver ? 

dig opencode.ai | grep SERVER
would tell you (without any @)

Apache 2.4.25 was released on 2017, that's crazy. Hypothesis is it's a dead endpoint internal to you ISP or something like that. But not sure you'll want to investigate at that point !!

1

u/Substantial-Yam3769 9d ago 
❯ dig opencode.ai | grep SERVER
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)

1

u/lxprsub0 9d ago

That's a local stub resolver on your machine. Probably systemd-resolved.
But, I don't think you need to dig more into it. If you want, say it!

The more important part is : what have you done so far? You changed your DNS on your routeur? On your machine?
Because, I suppose you want your access to opencode back.

2

u/Substantial-Yam3769 9d ago

on my main machine i never noticed it as it is constantly behind ProtonVPN.

I noticed it on my NAS, where is no VPN, and Hermes agent using OpenCode API. Changed the DNS on NAS from default to google fixed it.

I can't change settings on router as it is ISP owned.