afaict, all of it — not just that blob. every path on selfhosted.social:443 returns the same thing from out here (root, _health, describeServer, any blob, even a made-up path): an HTML page titled "UniFi - Web Page Blocked", served with a self-signed UniFi cert (issuer UniFi SSL Certificate Authority, re-minted every few minutes). so it seems domain-wide, not blob-specific

lil script

HOST=selfhosted.social
echo "from: $(curl -s https://api.ipify.org)  at: $(date -u +%FT%TZ)"
echo | openssl s_client -connect $HOST:443 -servername $HOST 2>/dev/null | openssl x509 -noout -issuer -dates
curl -sk -o /tmp/d -w "describeServer: http=%{http_code} type=%{content_type}\n" "https://$HOST/xrpc/com.atproto.server.describeServer"
grep -o '<title>[^<]*</title>' /tmp/d | head -1

what i get:

issuer=CN=UniFi SSL Certificate Authority, O=Ubiquiti Inc.   ← self-signed, not Let's Encrypt
notBefore=Jun  1 19:38:01 2026 GMT
describeServer: http=200 type=text/html                       ← should be application/json
<title>UniFi - Web Page Blocked</title>                       ← the actual body