From the workshop. This first appeared in the build log of Privacy Guardian, a tool we are building to find and remove personal data from people-search sites. It has not launched.
The probe ran against all five broker sites. Every one came back with a 403, which is exactly what you would expect from sites known to sit behind aggressive bot protection.
It was the wrong conclusion, and the probe helped reach it.
Reading the body
A 403 from a people-search site usually means its bot protection decided the request looked automated. That had been the working assumption for days, so the result looked like confirmation rather than a surprise.
Then the obvious question that nobody had asked: what is actually in the response? Ninety-seven bytes of plain text.
Host not in allowlist: nuwber.com.
Add this host to your network egress settings to allow access.
That is not a site's bot protection. It is the proxy the development environment sends outbound traffic through, refusing to open a tunnel. The request never left the building. Nothing had been learned about the scrapers, the selectors or the sites, because none of them were ever involved.
Why it is worth writing down
Imagine not checking. The conclusion would have been "all five scrapers are blocked by the sites", and the obvious next step is a day of work on headers and browser automation, aimed at a problem that does not exist and tested against a page that was never fetched. The fix would appear not to work, which suggests trying harder, and that loop has no exit.
The same trap is waiting for anyone who runs a scraper from an office network, a VPN with a filtering policy or a locked-down CI runner. A corporate web filter's 403 looks just like a site's.
It waits here too. The machine this site's own tools run on sits behind the same kind of proxy, and the fetcher we use for research now reports a refused host as refused by this environment rather than by the site, and does not try another way round.
So the scrapers say which it was
There is now a separate outcome, distinct from being blocked: the network this scraper runs on refused the request, and the site was never reached. The diagnosis names the signature it matched, says plainly that no selector change will help, and says to allow the host and run again.
It is not retried, either. Retrying a site that challenged you is worth a second attempt. Asking your own proxy the same question twice is not.
And the result says it in a person's language: not "blocked by the site" but "this server could not reach the site". Those describe different problems, and only one of them is the site's.
The lesson, which is old
A status code is a summary somebody else wrote. The body is the evidence. Read the body before acting on the summary, especially when the summary is the one you expected.