TSPU Filtering Disrupts Timeweb Cloud Servers: Diagnosis, CDN Failures, and Reverse Proxy Bypass
Russian hosting provider Timeweb Cloud began experiencing selective TSPU filtering in early June that prevented clients from accessing WordPress sites without a VPN. Two commercial sites hosted on the same VPS stopped opening for users in the same city and later for the administrator connecting over a wired connection.
Initial troubleshooting ruled out fail2ban, Google Captcha, registry blocks by Roskomnadzor, and judicial decisions. Competitors on other providers remained accessible, pointing to a provider-specific issue. The observed behavior showed TCP connections on port 443 establishing successfully, followed by a missing Server Hello and a 20-second timeout, while SSH on port 22 and ICMP traffic continued without loss.
The filtering proved dynamic: it initially blocked by SNI at night, later switched to IP-based blocking by midday, and intermittently relaxed in the evening. Timeweb support acknowledged the problem on June 5 in ticket 12068181, attributing it to changes in TSPU settings and noting that the issue varied by operator, region, and browser. Similar reports appeared from Beget and Selectel around the same period.
Obtaining new IP addresses proved ineffective, with filtered behavior recurring on fresh addresses. DNS record updates after IP changes also caused extended outages. Attempts to place Yandex Cloud CDN in front of the origin succeeded for static content but failed for any POST requests, returning 405 errors for wp-login.php, cart operations, and AJAX calls.
A stable workaround used a minimal nginx reverse proxy on a separate Russian cloud VPS. The configuration correctly forwards the Host header and SSL server name, supports all HTTP methods, and includes tuned proxy buffers to prevent 502 errors on large cookie responses from logged-in WordPress administrators. ACME challenge paths are explicitly proxied to allow Let's Encrypt certificate issuance, and a synchronization script copies updated certificates from the origin server.
Testing with curl --resolve allowed validation of both GET and POST functionality before DNS cutover. Additional community suggestions include disabling TLS 1.3 or requesting subnet whitelisting through legal entities, though these were not tested in this case.
Later tickets submitted to Timeweb in July received requests for mtr traces, which cannot detect selective DPI interference because the mechanism allows TCP establishment before dropping TLS packets. Support closed the tickets claiming resolution despite ongoing symptoms reported by clients.
Related articles
Gesture Dynamics CAPTCHA Emerges as Privacy-Focused Drop-in Alternative to reCAPTCHA
A new open-source CAPTCHA system called Aptogon replaces traditional image-based challenges with analysis of hand gesture dynamics to verify human users. Instead of clicking on traffic lights or buses, visitors draw a free-form gesture for about ten seconds while the system measures velocity variance, pause entropy, rhythm irregularity, and micro-corrections that distinguish human motor patterns from bots. The solution addresses recent reCAPTCHA restrictions, including Google's reduction of free monthly verifications from one million to ten thousand and tightened GDPR data responsibility rules starting in April 2026. An iframe architecture loaded from the vendor origin eliminates cross-origin issues and CORS blocks while supporting public and secret key pairs for domain validation. Machine learning relies on a local gradient boosting model for confident decisions and an LLM only for borderline cases, with fail-closed behavior returning 503 errors when the classifier is unavailable. Coordinates never leave the browser; only derived statistics are sent, satisfying GDPR requirements without cookie banners or biometric templates. The project is released under AGPL-3.0 with a free tier of one thousand checks per month and integration examples for HTML, React, Node, Python, and PHP.
Cat Tunnels Service Deploys Kotator-Rotator to Counter Mass Blocking of Relay Nodes in Russia
The operators of the decentralized Cat Tunnels service faced a sudden wave of blocks that disabled all several dozen of their tracker nodes inside Russia. Without these anchor relays, new user connections slowed dramatically and existing sessions degraded. The team responded by building Kotator-Rotator, an automated system that continuously evaluates node reachability from the client side and replaces failing relays with fresh instances. The decision engine relies on Grohotator, an aggregated availability metric derived from client technical logs that also triggers an audible alarm when thresholds are crossed. Analysis of the logs revealed that blocking activity follows a clear weekday pattern, pausing on Friday evenings and resuming Monday mornings. The experience demonstrated that server-side health checks alone are insufficient when censors interfere with paths between clients and relays.
Google Chrome Tests Visible Global Privacy Control Toggle in Canary
Google is testing a new visible toggle for Global Privacy Control in Chrome Canary that lets users send a standardized request asking websites not to sell or share their personal data and not to use it for targeted advertising. When enabled, the browser adds the Sec-GPC: 1 header to web requests and exposes the setting via navigator.globalPrivacyControl. In regions with supporting laws such as California's CCPA, the signal can serve as a formal opt-out from data sales. The feature currently appears primarily on Android, with experimental flags available on Windows, macOS, Linux, and ChromeOS, though the desktop interface remains incomplete. Two separate flags are required—one to show the toggle and another to actually transmit the signal—because enabling only the UI does not send Sec-GPC: 1. The mechanism is not a guaranteed enforcement tool; websites decide how to respond, and effectiveness depends on legal frameworks and site compliance. The feature is absent from the stable Chrome release and may still change before wider rollout.
OpenAI ChatGPT Computer History Feature on macOS Could Expose Detailed User Activity Logs to Infostealers
OpenAI has introduced the Computer History feature in its macOS ChatGPT app, which records application switches, clicks, keystrokes, and accessibility context to generate AI summaries and memories. The feature is disabled by default and requires explicit activation of Memories, with availability limited to Pro, Business, and Enterprise users outside the EEA, Switzerland, and the UK. While raw event files are deleted after 48 hours and not used for model training, the resulting Markdown memory files remain unencrypted on the local Mac. These files can be read by any process running under the same user account, creating a ready-made activity log for infostealers and other malware. OpenAI also warns about prompt injection risks where hidden instructions from websites or apps could influence ChatGPT or Codex behavior. Users retain controls to select participating apps, pause collection, or delete history, but the lack of encryption on stored memories raises significant privacy concerns.