Reachability check: is this site filtered, or down?
Tells you whether a site opens from the IPVIEW origin nearest you — the server inside Iran for visitors there, the one in Germany for everyone else — and the result says which. From inside Iran it does more: it separates being filtered from the site itself being down by reading three signs — a forged DNS answer, a connection reset the moment the domain name is readable in the TLS handshake, and a block page injected over HTTP — and comparing them with a vantage point outside Iran, so that "filtered" is never confused with "not up at all". From outside Iran there is no second vantage point, so the answer is one-sided and says so.
Need another tool?
Pick one of the 25 belowOutput
What the reachability check measures
Three probes run from the IPVIEW origin nearest you, each chosen because it fails in a distinguishable way. DNS asks Cloudflare, Google and Quad9 directly for the A record and treats an unroutable answer such as 10.10.34.36 as injected. TLS opens port 443 with the domain name in the handshake and notes a reset that arrives after the connection was made, the signature of the name being inspected. HTTP fetches the front page over port 80 and reads the reply for a known block page.
The address the connecting probes use comes from outside the network wherever possible, never from a poisoned answer, which would point at the filter's own web server and make a filtered site look healthy. From inside Iran a second vantage point abroad runs the same code and the two results are compared. From outside Iran there is no second point: the answer is one-sided and the page says so, because whether a site is blocked in Iran can only be asked from Iran.
How to read the result
The verdicts are Opens, Filtered, Unreachable, The server itself is down, No such domain and Inconclusive. Filtered needs either direct evidence, an injected DNS answer, a post-connection TLS reset or a block page, or the inside probes failing while the outside ones succeed. The server itself is down needs both vantage points to have failed to connect, with no sign of interference at either. Unreachable is the honest answer when only one side measured and the site did not answer: blocked only from here and down for everyone have not been told apart, and a line under the result says so.
Measured from Germany, a failure is called Blocked from here rather than Filtered, because that word is a claim about Iran's network. Under the headline, each probe lists what it saw, with the errno or the block page marker and status code beside it, and the resolver tables show what each of the three answered on each side: with a poisoned name, one column routes and the other is the same private address three times.
When it is useful
A site stops opening for your users in Iran and you need to know, before anyone touches the server, whether the server is at fault. Filtered means no change on the server will help; The server itself is down means the network is not the problem. DNS records and Ping cannot settle this: a forged answer looks like a record, and a filtered host often still answers ping.
When another tool shows an address inside 10.0.0.0/8 for a public name, this one names what happened. If the verdict is Unreachable from one vantage point, Traceroute and MTR show where the path stops.
Common questions
How do I check whether a site is filtered in Iran?
Enter the domain while visiting from inside Iran. The check runs from the IPVIEW server there, compares with a server abroad, and says Filtered only when the site opens there and not here, or when a forged DNS answer, a TLS reset or a block page was seen directly.
Why does it say Blocked from here instead of Filtered?
Your visit reached the origin in Germany, so the probes ran from Germany. A failure there says something about that path and nothing about Iran's network.
Why does it need a domain name and not an IP address?
What is filtered is the name: once in the DNS answer and once in the TLS handshake where it is readable. An address gives the probes nothing to observe.
What does Unreachable mean?
The site did not answer from the only vantage point that measured it and no sign of filtering was seen. Without a second point, a server that is down and a path that is blocked look the same, so neither is claimed.
Limits. The DNS, WHOIS and SSL tools allow up to 20 requests a minute per IP address. Ping, traceroute and MTR send real packets to their target, so they allow 6 a minute.
The port check runs only against your own IP address. That is deliberate: the question people actually have, "is this port reachable from outside?", is answered by it, while this server cannot be used to scan anyone else's network.
Private and reserved addresses. These are refused by the tools that really connect to their target: the SSL check, ping, traceroute, MTR and the port check. The DNS tools have no such limit, because they only ask a nameserver a question and never connect to the address itself.