DNS injection on *.global.ssl.fastly.net in China

[jknockel]

On a Chinese vantage point, I am measuring DNS injection on any domain lookup matching the pattern *.global.ssl.fastly.net, including the ones listed in README.md:

jeffrey@tycho:~$ dig +short @1.1.1.1 doesnotexist.global.ssl.fastly.net
192.133.77.197
jeffrey@tycho:~$ dig +short @1.1.1.1 doesnotexist.global.ssl.fastly.net
69.171.242.11
jeffrey@tycho:~$ dig +short @1.1.1.1 doesnotexist.global.ssl.fastly.net
199.59.149.206
jeffrey@tycho:~$ dig +short @1.1.1.1 doesnotexist.global.ssl.fastly.net
67.228.102.32
jeffrey@tycho:~$ dig +short @1.1.1.1 doesnotexist.global.ssl.fastly.net
128.242.240.155

Sites mirrored on *.global.ssl.fastly.net may no longer be useful for evading censorship in China.

[UjuiUjuMandan]

A good progress. Let’s see how many innocent sites now down in China.

Actually I think the censor can be more precise on this, the mirror site domain on Fastly is distinguishable enough, dedicated for that one CDN customer only.