I have a lot of bad guys in /etc/hosts pointing to 0.0.0.0
If I use
host to check the domain name, I get an actual IP address instead of 0.0.0.0
What I expected the resolver to give me is the same thing that is in the hosts file. What I expected from any other access is a failure (timeout).
But when the resolver provides the real IP, I would expect a browser to show the bad guy's website. Instead, both Safari and Firefox show "Blocked!!" with the same font, font size, positioning, etc. The HTML is identical:
suggesting that it comes from somewhere/something else. Where does this HTML come from? What would happen if the Mac tried to go there on some other (non-http/https) port?
This is the latest MacOS update on a 2012 MacBook.