exploraz

It used to be like that when they still used "/url?..." redirect links, which have the destination URLs clearly exposed. Maybe it's an intended feature for checking out where does the link leads to. That behavior can be prevented by browser extensions.

Now, on desktop Firefox (private browsing mode, logged out), I see that it always links to the opaque goto URLs, instead of only overwriting on interaction.

Using Google Search while logged in on Chrome Android still presents the older non-opaque /url?... links though.

It's unfortunate that we cannot immediately inspect what the link will lead to, whether the link is the intended (and safe/expected) destination or not.

... for some reason (inside a script tag for me)

It never got overwritten back to the original destination URL with the same browsing environment (see my other comment).

I encountered that on Firefox (with privacy setting both on strict, and I think also on default protection last time I encountered that) both on Android and desktop, and also Safari (iOS). Not sure about Chrome though.

... for pushing a commit.

Disregard. Now it's archived again

... and now it isn't as I'm writing this

Other hypotheses:

- VPN/Proxy/Datacenter IP/Tor usage

- Censorship bypass tools triggering destination server's firewall (suspicious TLS fingerprint or connection characteristics, or bad proxy IP)

- Bad ISP (e.g. one ISP IP address or range of addresses shared by so many users that could create collateral damage if one or more user gone rogue)

- Actual botnet/hidden residential proxy exit node on the same IP/local network (e.g. TV boxes or SDKs embedded inside apps that users are not aware of)

- Strict privacy settings (unlikely to cause 403 straight away), or obscure browsers (also unlikely, but can trigger firewall because of connection fingerprint/characteristics)

- Actual bad behavior (scraping, etc)

Still working for me, your IP or browser request might be flagged by their firewall or anti-bot protection