Индикаторы из утечек
39 строк: адреса, домены и сервисы, которые названы в публикациях об утечках и в открытых источниках. Содержимое самих утечек здесь не воспроизводится; указано, откуда взят индикатор.
Появление в списке не доказывает, что адрес или домен принадлежит РКН или ТСПУ, и не подтверждает сам факт утечки. Метка — исходная метка корпуса. Контакты и учётные данные скрыты (6 строк).
| Значение | Тип | Контекст | Происхождение | Впервые | Метка корпуса | Источник | Заметки | Связи |
|---|---|---|---|---|---|---|---|---|
| 195.208.6.1 | ipv4 | NSDI recursive resolver (national DNS of RU; upstream for ISP resolvers) | leaked corporate letter circulating on Telegram | 2021-09 | high | github.com leaked-indicators.csv, строка 2 | from photo of letter; status in 2026 unverified | |
| 195.208.7.1 | ipv4 | NSDI recursive resolver | leaked corporate letter circulating on Telegram | 2021-09 | high | github.com leaked-indicators.csv, строка 3 | — | |
| 2a0c:a9c7:a::1 | ipv6 | NSDI recursive resolver | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 4 | — | |
| 2a0c:a9c7:b::1 | ipv6 | NSDI recursive resolver | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 5 | — | |
| 195.208.4.1 | ipv4 | state resolver checked during whitelist-mode blackouts (Megafon mobile) | community measurement of TSPU whitelist behavior | 2025 | medium | github.com leaked-indicators.csv, строка 6 | measurement-derived; likely NSDI-family | |
| 8.8.8.8 | ipv4 | target of 2021 DNS blocking order (listed in leaked letter as to-be-restricted) | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 7 | third-party infra; included as rule parameter from leak | |
| 8.8.4.4 | ipv4 | target of 2021 DNS blocking order (leaked letter) | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 8 | — | — |
| 1.1.1.1 | ipv4 | target of 2021 DNS blocking order (leaked letter) | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 9 | — | |
| 1.0.0.1 | ipv4 | target of 2021 DNS blocking order (leaked letter) | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 10 | — | — |
| doh.opendns.com | domain | target of DoH restriction (leaked letter 2021) | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 11 | — | — |
| epp.noc.gov.ru | host | CMU SSOP applicant portal (Единый портал пользователей) | named in leaked letter 2021 + official | 2021-09 | high | github.com leaked-indicators.csv, строка 12 | instruction access point for ISPs onboarding to NSDI | |
| portal.noc.gov.ru | host | CMU SSOP portal (ЦМУ ССОП) | official (referenced in leak context) | 2023 | high | — leaked-indicators.csv, строка 13 | tasker portal of CMU; NOT a leak source itself | |
| cmu.gov.ru | host | CMU SSOP domain | official; contacts from Apr-2025 RKN notice | 2025-04-10 | high | rkn.gov.ru leaked-indicators.csv, строка 14 | — | |
| [контакт скрыт] | CMU SSOP 24/7 duty shift contact | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 15 | — | — | |
| [контакт скрыт] | phone | CMU SSOP 24/7 duty shift phone | leaked corporate letter | 2021-09 | high | github.com leaked-indicators.csv, строка 16 | — | — |
| [контакт скрыт] | CMU SSOP whitelist submission address | official RKN notice (not a leak) | 2025-04-10 | high | rkn.gov.ru leaked-indicators.csv, строка 17 | channel where businesses submit their own IPs — registry of RU VPN endpoints | — | |
| [контакт скрыт] | RKN mailbox for VPN whitelist applications | official RKN press release 14.05.2021 (corroborates leaked bank email) | 2021-05-14 | high | github.com leaked-indicators.csv, строка 18 | — | — | |
| [контакт скрыт] | RKN mailbox for hosting/ISPs | official (context for registry workflow) | — | high | — leaked-indicators.csv, строка 19 | — | — | |
| w.ranr.noc.gov.ru | host | RANR — Russian RIPE-like registry (whois/ASN substitution) | official; surfaced via net4people discussion | 2026-04 | high | github.com leaked-indicators.csv, строка 20 | — | |
| 10.<region>.<site>.0/24 | scheme | TSPU management segment addressing plan (bypass/balancer/filter/BMC/IPMI/SPFS) | internal TSPU training lecture transcribed (tspu-docs) | 2022-2024 | medium | github.com leaked-indicators.csv, строка 21 | addressing scheme not literal dump | — |
| [учётные данные скрыты] | creds | Default TSPU EcoFilter CLI credentials | internal TSPU training lecture (tspu-docs) | — | medium | github.com leaked-indicators.csv, строка 22 | flag only; not for use | — |
| www.youtube.com | domain | NSDI NXDOMAIN (13 of 50 domains removed Feb 2026) | The Insider measurement after NSDI outage reports | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 23 | full list: web.whatsapp.com windscribe.com apkmirror.com bbc.com currenttime.tv dw.com facebook.com instagram.com messenger.com svoboda.org themoscowtimes.com torproject.org | — |
| www.web.whatsapp.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 24 | — | — |
| www.windscribe.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 25 | — | — |
| www.apkmirror.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 26 | — | — |
| www.bbc.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 27 | — | — |
| www.currenttime.tv | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 28 | — | — |
| www.dw.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 29 | — | — |
| www.facebook.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 30 | — | — |
| www.instagram.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 31 | — | — |
| www.messenger.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 32 | — | — |
| www.svoboda.org | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 33 | — | — |
| www.themoscowtimes.com | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 34 | — | — |
| www.torproject.org | domain | NSDI NXDOMAIN 2026-02 | The Insider | 2026-02-12 | high | theins.ru leaked-indicators.csv, строка 35 | — | — |
| dataset:github.com/openlibrecommunity/twl | dataset | Measured TSPU mobile whitelist: 63126 IPs / 2557 ASN (weekly refresh) | reverse-engineering via Megafon BS interface | 2026-04 | high | habr.com leaked-indicators.csv, строка 36 | machine-readable CIDR/IP lists in repo | — |
| dataset:raw.githubusercontent.com/d010b/custom_geoip/refs/heads/main/whitelist_url.txt | dataset | Whitelist URL/IP list aggregated from measurements | community aggregation | 2026 | medium | checkvpn.net leaked-indicators.csv, строка 37 | — | — |
| dataset:reestr.rublacklist.net | dataset | Roskomsvoboda mirror of EAIS unified register; daily snapshots since 2016; API v3 | legal export of official register | 2016 | high | iiiypuk.me leaked-indicators.csv, строка 38 | IP/URL/domain entries with violation type | — |
| api:api.reestr.rublacklist.net/check?domain= | endpoint | Blacklist check endpoint | official mirror API | — | high | — leaked-indicators.csv, строка 39 | — | — |
| eais.rkn.gov.ru/en/StateInfoJson?method=getSections | endpoint | EAIS JSON API (sections/entries export) | official registry API (parser: github.com/3xh4l3/rkn-blacklist) | — | medium | github.com leaked-indicators.csv, строка 40 | host often geo-blocked outside RU | — |