Russian TSPU Systems Redirect DNS Queries to Google and Cloudflare Servers Toward National Domain Name System

Since the evening of August 26, Russian technical means of countering threats (TSPU) began intercepting open DNS queries sent to Google and Cloudflare public resolvers. For domains such as YouTube and RuTracker, UDP-based queries received NXDOMAIN responses while TCP queries successfully reached the original servers and returned valid IP addresses. Analysis with low TTL packets revealed that responses originated from IP address 195.208.5.1 belonging to the National System of Domain Names (NSDI). The mechanism performs targeted DNAT on recognized DNS traffic, making the query appear directed to NSDI rather than the foreign resolver. The redirection is imperfect, allowing subsequent identical queries sent in quick succession to bypass the system and reach Google. The findings come from experiments conducted by Habr user angry_agent and have not yet received official confirmation from Russian authorities.

AntiMalwareAugust 27, 2026Translated from Russian

Read at source

Since the evening of August 26, Russian TSPU (technical means of countering threats) have started redirecting open DNS queries addressed to Google and Cloudflare public DNS servers toward the National System of Domain Names (NSDI). The change affects users of multiple Russian internet providers and coincides with ongoing implementation of content filtering systems required by Russian legislation.

When a standard UDP DNS query is sent to addresses such as 8.8.8.8 or 1.1.1.1 for domains including YouTube and RuTracker, the response returned is NXDOMAIN, indicating that the domain does not exist. In contrast, identical queries sent over TCP successfully reach the original servers and obtain genuine IP addresses.

Further traffic analysis by Habr user angry_agent showed that packets with a deliberately low TTL value elicited ICMP TTL Exceeded messages containing the IP address 195.208.5.1, which belongs to NSDI. The same behavior was not observed with arbitrary UDP packets, confirming that the system specifically inspects DNS traffic.

According to the researcher, TSPU devices recognize open DNS queries and perform a directed DNAT operation, transparently altering the destination address so that the packet is delivered to an NSDI server. The national resolver then decides what response to return to the user. From the perspective of the network operator, the query appears to have been sent directly to NSDI rather than to a foreign resolver.

The mechanism is not flawless. When several identical queries are transmitted rapidly, the first request receives an NXDOMAIN response while subsequent requests reach Google and return correct addresses. Redirection also does not occur for every public DNS server tested.

No official statement confirming the new redirection technique has been issued by Russian authorities or network operators. The conclusions are based solely on the experiments of a single researcher. The development follows reports from users of several Russian providers who experienced difficulties accessing protected DNS services operated by Google and Cloudflare.

Cloudflare Google YouTube NSDI RuTracker

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately

The article provides a detailed guide on strengthening iPhone privacy by limiting unauthorized access to messages, location data, photos, and cloud backups. It explains how to set a strong alphanumeric passcode, enable Stolen Device Protection, and restrict lock screen notifications and widgets. Users are advised to review Apple ID security, enable Advanced Data Protection for iCloud, and minimize app permissions for location, contacts, and camera. Additional steps include turning off cross-app tracking, using private Wi-Fi addresses, and activating Lockdown Mode for high-risk scenarios. The guide emphasizes regular updates, encrypted local backups, and periodic audits of shared access and active sessions to maintain long-term protection.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026

Public DNS resolvers differ significantly in their ability to block malicious domains, filter advertising and tracking, respect user privacy, and support modern encryption protocols. The guide evaluates ten services including Quad9, Cloudflare, AdGuard DNS, NextDNS, Control D, CleanBrowsing, Mullvad DNS, DNS4EU, Google Public DNS and DNS.SB, providing IPv4 addresses, DoH and DoT endpoints, and recommended use cases. Key distinctions include Quad9’s focus on phishing and malware blocking without logging, Mullvad’s strict no-logs policy requiring encrypted protocols only, and DNS4EU’s EU-based infrastructure with mandatory court-ordered blocks. The article explains why DNSSEC and encryption alone are insufficient and outlines four practical selection criteria: threat filtering quality, data-handling practices, encryption support, and network stability. Detailed configuration instructions cover Windows 11, Android, iOS, and home routers, along with verification methods and warnings against mixing providers with conflicting policies.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers

The article from Aurorium details how WebRTC technology can leak real IP addresses even when users route traffic through proxies. It explains the peer-to-peer mechanics of WebRTC, the role of STUN servers in generating ICE candidates, and why standard TCP proxies fail to handle UDP traffic. Disabling WebRTC via flags or JavaScript extensions creates detectable anomalies that anti-fraud systems flag as non-standard environments. The recommended approach involves native emulation inside the browser kernel so that STUN requests return proxy IPs while preserving full API integrity across workers. Additional leaks through local network addresses, mDNS candidates, and IPv6 are also covered with practical verification methods using tools like BrowserLeaks and CreepJS.

HabrOct 26, 2026Translated from Russian