Yes, in your case this is ok. Because your call comes from a blocked IP of “IL” currently. From MY location with the same curl-command I can see the source-code perfectly.
I have canceled the brute-force-lock and you should be able to see the page now, too.
But: Let me tell you again: This has nothing to do with the traffic from “real”-Twitter-ASN/ISP and twitterbot itself! Every access from the real Twitterbot will be passed by! This worked perfectly for years - 'til last week. I still cannot see any blocked traffic from twitter and twitterbot in the server-log. All calls from there are ok.
So I understand the error message by Card Validator:
INFO: Page fetched successfully
WARN: No metatags found
So there can’t be a block or anything else for Twitterbot, because the error message says itself that the page is readable (“Page fetched successfully”) and also the meta-tags for the twitter-cards are available in the “Head”-section! Logically, the Twitterbot can not be blocked by my website!
I think to solve the problem, a “Twitter”-employee would have to do a test directly with the real Twitterbot.