How & why do "0.0.0.0" connections get a response?
As I said in a comment, host is misleading because it bypasses the system resolver  (and /etc/hosts) and queries DNS directly. The 0.0.0.0 entries are probably working normally.

From my tests it appears connections to 0.0.0.0 actually connect to localhost (specifically 127.0.0.1), so that &lt;html&gt;&lt;body&gt;&lt;h1&gt;Blocked!!&lt;/h1&gt;&lt;/body&gt;&lt;/html&gt; message must be coming from a web server running on your own Mac.

You can confirm this by running sudo tcpdump -Aqns0 -ilo0 port 80 to watch the raw connection. Note that it'll ask for your admin password, but will not echo anything as you type. Also, you'll have to use Control-C to exit it. In the output, you'll see traffic back &amp; forth between two different ports on 127.0.0.1 (ports 80 and whatever your browser is using), but in the request you'll see a "Host:" header indicating the site name the browser is trying to reach.

So... why is a web server running on your Mac, and why is it serving a "Blocked!" message? I have no idea, do you?