On 16 September, Spain’s Intellectual Property Commission ordered the blocking of archive.today, the web archiving service that a good deal of the internet quietly depends on for citation. If you run a product that Spanish customers use, the interesting part of that story is not the archive. It is that the block is partial, it varies by network, it returns a valid HTTP response, and not one of the monitoring tools you are paying for would have told you if it had been aimed at you instead.
TL;DR
- On Telefónica’s network, DNS resolves correctly and the block arrives as an HTTP 451 with a 600-byte body whose only content is a JavaScript redirect. That is a valid response, not a timeout.
- Public OONI measurement data shows the anomaly rate in Spain jumping from 20.9% to 46.4% overnight on 16 September, and still more than half of all requests succeeding.
- Across 4,196 measurements, OONI’s automated classifier confirmed the block zero times, because Spain’s blockpage signature is not in its fingerprint database.
- Your uptime monitoring probes from cloud regions using its own resolvers. It answers “is the origin up”, never “can customers in Spain reach us”.
What Spain actually did
The order came from the Sección Segunda of the Comisión de Propiedad Intelectual, a collegiate body attached to the Ministry of Culture. Its remit and composition sit in Articles 193 and 195 of the consolidated Intellectual Property Act (Royal Legislative Decree 1/1996), developed by Royal Decree 1130/2023. The Commission’s own documentation is explicit that it acts exclusivamente a instancia de parte, meaning only on the application of a rightsholder.
The failure does not look like a failure
We pulled a raw measurement recorded on Telefónica de España (AS3352) on the evening of 16 September. It is worth reading closely, because the shape of it is the entire problem.
DNS resolved correctly. The probe got a clean A record for archive.today pointing at 45.88.200.214, and OONI marked DNS consistency as consistent. The TCP connection succeeded. The HTTP request returned a status code. The status code was 451, the RFC 7725 code for content unavailable for legal reasons, which is the technically correct thing for an ISP to return and is more honest than most jurisdictions manage.
The body was roughly 600 bytes. Its title element read R_BLOQUEOS_CPI. It contained no prose at all. The only functional content was a script tag calling window.location.replace() to send the browser to bloqueadaseccionsegunda.cultura.gob.es, where the actual notice lives, headed “ESTÁ USTED INTENTANDO ACCEDER A UN SITIO WEB ILEGAL”.
Now consider what your monitoring makes of that. A curl-based check receives a fast, well-formed HTTP response from the correct IP address. A check asserting status < 400 fires an alert whose text is “unexpected status 451”, which nobody on your on-call rota has a runbook for. A check asserting only that the host responds passes cleanly. And a headless-browser check follows the JavaScript and lands somewhere entirely different from the page it was asked about, which most synthetic monitoring will score as a content mismatch rather than as a government block.
Other measurements from the same period were classified as DNS blocking rather than HTTP. Both mechanisms are in play on different networks, which means the failure signature your users experience depends on which ISP they are with.
What the public data actually shows
OONI, the Open Observatory of Network Interference, runs a volunteer probe network and publishes every measurement through a free API. We queried it directly rather than reading anybody’s summary. The aggregation endpoint takes a country code, a domain and a date range:
curl "https://api.ooni.io/api/v1/aggregation?probe_cc=ES&domain=archive.ph\
&since=2026-09-01&until=2026-09-21&axis_x=measurement_start_day"For archive.ph in Spain, the fortnight before the order produced 73 anomalies across 350 measurements, a rate of 20.9%. From 16 September to 20 September, 58 anomalies across 125 measurements, a rate of 46.4%. The sister domain archive.is moves the same way, from 18.5% to 39.1%. The block is visible in public data as a clean step change, and you can reproduce those numbers in a single HTTP request.
Read the other half of that figure, though, because it is the half that will cost you money. Even after the order, more than half of all measurements still succeeded. Spanish users on Hacker News reported the same thing in real time, some blocked, some entirely unaffected on the same major ISPs. A block that catches half a country is not a binary outage. It is a slow degradation that arrives as support tickets, abandoned checkouts and a churn number nobody can explain.
Anomaly is not the same as confirmed
Across all 4,196 archive.ph measurements in Spain since June, OONI’s confirmed_count is zero. Not low. Zero. A state-ordered block, served with a legally correct status code, redirecting to a government domain, and the automated classifier never once called it confirmed blocking.
We went and read the fingerprint database to find out why. It is a public CSV of 1,738 signatures. The only pattern that matched the Spanish blockpage is cp.f_gen_loqueada, whose scope is vbw and whose pattern is the literal substring loqueada. In OONI’s taxonomy, inherited from Citizen Lab, vbw means “vague blocking word”: a string too generic to treat as proof, because it could equally be a captive portal or a corporate filter. Of the 1,738 entries, 239 are national blockpages and exactly one names Spain, ooni.es_0, which is also scoped vbw and matches a different page entirely. Neither R_BLOQUEOS_CPI nor the government domain in the redirect appears anywhere in the file.
A classifier can only confirm what is already in its vocabulary, and every alerting system you own has the same limit. The rule matches known strings; the unknown failure scores as noise and gets tuned out. We have made this argument before about search visibility, where absence from a surface looks identical to never having measured it. This is the same shape one layer down, at the network rather than the index, and it is worse here because the thing being measured is whether customers can reach you at all.
You do not have to be the target
Spain has form for this, and the collateral is the part that should concern a business with no piracy exposure whatsoever. Under separate dynamic blocking orders obtained by LaLiga, Spanish ISPs have blocked Cloudflare edge addresses during football fixtures. TorrentFreak’s reporting in April 2025, citing a sysadmin tracking the blocks, put the rate at roughly 3,000 Cloudflare IP addresses per week, with one blocked address serving 12,382 unrelated domains.
What to change this week
- Probe from consumer networks in every market you sell into. Cloud regions are the wrong vantage point by construction: blocks are applied at the ISP, and AWS Frankfurt is not an ISP. Most synthetic monitoring vendors offer residential or mobile vantage points, and almost nobody enables them.
- Use the local resolver, not yours. A probe hard-coded to 1.1.1.1 or 8.8.8.8 is immune to exactly the DNS-level enforcement that half these orders use. Nobody chooses a resolver deliberately, which is a problem we have written about as a procurement gap; here it is a blind spot in your own test harness.
- Assert on content, not on status codes. Your check should require a known string from your own page. Any response that does not contain it is a failure, whatever the status code says.
- Give 451 its own alert class. It means something specific and legal, it needs a named owner, and it should never be swallowed by a generic 4xx rule.
- Find out who shares your IP. Ask your CDN whether you are on a dedicated address in your key markets, and what it costs if you are not.
- Query OONI for your own domains, monthly. Use the anomaly rate trend, not the confirmed flag, for the reason set out above.
Reachability is not a property of your site
We think about archives as the answer to link rot, and durable addresses are a thing we have argued for at length. What Spain demonstrates is that the backstop has a jurisdiction. An archived URL is not permanent; it is permanent from some networks.
The same correction applies to your own uptime number. It is not a property of your infrastructure. It is a property of a path between one specific network and your origin, and you have measured exactly one such path, from a datacentre, on a resolver you chose. Everything your customers experience happens on paths you have never tested. A green dashboard is a claim about your servers. It was never a claim about your customers.
If you would like someone to build the probes, work out who you share an edge address with, or review what your monitoring is actually asserting, get in touch. Infrastructure, DevOps and platform resilience are what our team does.
📷 Photo by Ries Bosch on Unsplash
