Triplet Censors: Demystifying Great Firewall’s DNS Censorship Behavior
summary
Measures 2.8 billion DNS queries to a Chinese VPS over nine months against the Alexa Top 1M and observes ~120 million forged responses, about 24–24.6k censored domains with a sharp drop after a November keyword change. Finds groups of domains consistently mapped to a small set of public IPs, a November collapse from ~1,500 to ~216 injector IPs, and fingerprints three injectors — one mirrors the TTL — often returning up to three forged responses from the same path.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:24Overview
- 0:48Methodology
- 2:41IPs used in forged DNS responses
- 5:12How are domains being blocked
- 7:07Localizing the GFW Injectors
- 10:11Is the blocking consistent within China
related talks
20mWho Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path
29mGlobal Measurement of DNS Manipulation
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
47mDNS On Fire
27mAbuse of CPE Devices and Recommended Fixes
45mAll the Ways to Control the Internet and More
25mDark Side of the DNS Force
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks