NSDI

Russian TSPU Systems Redirect DNS Queries to Google and Cloudflare Servers Toward National Domain Name System

Since the evening of August 26, Russian technical means of countering threats (TSPU) began intercepting open DNS queries sent to Google and Cloudflare public resolvers. For domains such as YouTube and RuTracker, UDP-based queries received NXDOMAIN responses while TCP queries successfully reached the original servers and returned valid IP addresses. Analysis with low TTL packets revealed that responses originated from IP address 195.208.5.1 belonging to the National System of Domain Names (NSDI). The mechanism performs targeted DNAT on recognized DNS traffic, making the query appear directed to NSDI rather than the foreign resolver. The redirection is imperfect, allowing subsequent identical queries sent in quick succession to bypass the system and reach Google. The findings come from experiments conducted by Habr user angry_agent and have not yet received official confirmation from Russian authorities.

Russian TSPU Begins Intercepting UDP DNS Queries to Cloudflare and Google Public Resolvers

Starting on the evening of August 26, Russia's TSPU DPI system began actively intercepting plaintext DNS queries sent over UDP to public resolvers operated by Cloudflare and Google. Queries to 1.1.1.1 and 8.8.8.8 now return NXDOMAIN responses for blocked domains instead of the real IP addresses. The interception works exclusively on UDP; TCP-based DNS queries continue to receive legitimate answers from the original resolvers. Technical analysis shows the system performs targeted DNAT, rewriting the destination IP to the NSDI server at 195.208.5.1 only when a DNS query is detected inside the packet. Experiments with varying TTL values confirm that the redirection occurs after the traffic passes the TSPU node, and rapid successive queries can sometimes bypass the filter and return genuine records. The change affects netflow statistics visible to network operators, as traffic previously destined for foreign resolvers is now redirected domestically.