Russian TSPU Systems Redirect DNS Queries to Google and Cloudflare Servers Toward National Domain Name System
Since the evening of August 26, Russian TSPU (technical means of countering threats) have started redirecting open DNS queries addressed to Google and Cloudflare public DNS servers toward the National System of Domain Names (NSDI). The change affects users of multiple Russian internet providers and coincides with ongoing implementation of content filtering systems required by Russian legislation.
When a standard UDP DNS query is sent to addresses such as 8.8.8.8 or 1.1.1.1 for domains including YouTube and RuTracker, the response returned is NXDOMAIN, indicating that the domain does not exist. In contrast, identical queries sent over TCP successfully reach the original servers and obtain genuine IP addresses.
Further traffic analysis by Habr user angry_agent showed that packets with a deliberately low TTL value elicited ICMP TTL Exceeded messages containing the IP address 195.208.5.1, which belongs to NSDI. The same behavior was not observed with arbitrary UDP packets, confirming that the system specifically inspects DNS traffic.
According to the researcher, TSPU devices recognize open DNS queries and perform a directed DNAT operation, transparently altering the destination address so that the packet is delivered to an NSDI server. The national resolver then decides what response to return to the user. From the perspective of the network operator, the query appears to have been sent directly to NSDI rather than to a foreign resolver.
The mechanism is not flawless. When several identical queries are transmitted rapidly, the first request receives an NXDOMAIN response while subsequent requests reach Google and return correct addresses. Redirection also does not occur for every public DNS server tested.
No official statement confirming the new redirection technique has been issued by Russian authorities or network operators. The conclusions are based solely on the experiments of a single researcher. The development follows reports from users of several Russian providers who experienced difficulties accessing protected DNS services operated by Google and Cloudflare.
Related articles
Deleted Database Records Remain Recoverable in SQLite Files Despite DELETE Operations
A standard DELETE query in SQLite removes rows from the table view but leaves the actual data intact inside the database file until pages are reused. The pragma secure_delete setting controls whether freed pages are zeroed immediately or simply marked as available. With the default setting of 0, strings containing names and credit card numbers can still be extracted using grep even after deletion. The same behavior appears in PostgreSQL through dead row versions until VACUUM runs and in MySQL InnoDB through undo logs and the binary log. The issue directly affects compliance with personal data deletion requests because backups, replicas, and analytics exports often retain the original records. Proper mitigation requires enabling secure_delete, running VACUUM after bulk deletions, or encrypting sensitive fields with per-record keys that can be destroyed on request.
HTTPS Lock Icon Present but List of Visited Sites Remains Visible
Even when HTTPS is active and passwords stay protected, DNS queries and the SNI field in TLS handshakes expose the exact domains a user visits over public Wi-Fi. Classic unencrypted DNS over UDP sends domain names in plaintext, allowing anyone on the same network to observe them with simple packet captures. The SNI extension reveals the target hostname before encryption is negotiated, enabling domain-based filtering without decrypting traffic. DNS over HTTPS moves queries inside encrypted channels but shifts visibility to the chosen resolver instead of the local network. Encrypted Client Hello offers partial protection for SNI yet requires support from both browsers and server infrastructure. The practical takeaway is that metadata about services used, timing, and frequency leaks more readily than credentials in modern public networks.
Russian TSPU Begins Intercepting UDP DNS Queries to Cloudflare and Google Public Resolvers
Starting on the evening of August 26, Russia's TSPU DPI system began actively intercepting plaintext DNS queries sent over UDP to public resolvers operated by Cloudflare and Google. Queries to 1.1.1.1 and 8.8.8.8 now return NXDOMAIN responses for blocked domains instead of the real IP addresses. The interception works exclusively on UDP; TCP-based DNS queries continue to receive legitimate answers from the original resolvers. Technical analysis shows the system performs targeted DNAT, rewriting the destination IP to the NSDI server at 195.208.5.1 only when a DNS query is detected inside the packet. Experiments with varying TTL values confirm that the redirection occurs after the traffic passes the TSPU node, and rapid successive queries can sometimes bypass the filter and return genuine records. The change affects netflow statistics visible to network operators, as traffic previously destined for foreign resolvers is now redirected domestically.
Google Develops Public Android API for On-Device Content Safety Classification
Google is creating a new public Android API that will allow third-party applications to analyze images and other files locally on the device and assign them one of four safety statuses. The system builds on the existing SafetyCore component already used in Google Messages to blur intimate images. ContentSafetyManager will process images, raw files, and multimedia content entirely on-device without transmitting data to Google servers. Applications will then decide whether to display, blur, or hide the content based on the classification result. Experts warn that malicious apps granted broad permissions could misuse the classifier to scan large volumes of user files and build detailed profiles. SafetyCore itself previously sparked controversy after being installed automatically without explicit user consent and without a visible icon, leading some users to install blockers to prevent reinstallation via the Play Store. Google continues to emphasize minimal permission requests and local processing as safeguards for user privacy.