They usually resolve to either other blocked websites to trigger a "dangerous website phishing" warning from the browser, or the ISP's own website pretending to be a captive portal.