Turkey’s ISPs hijack Google’s DNS service, killing bypass for Twitter, YouTube ban

Several ISPs in Turkey are hijacking traffic to a Google service that until Saturday offered locals a way around the government’s blockade on Twitter and YouTube.

Google on Saturday confirmed that its public domain name system (DNS) service was being intercepted by “most” Turkish ISPs. Until then, the service had been a popular way to bypass Turkey's Twitter and YouTube blockade beginning last week after an order from Turkey’s President, Recep Tayyip Erdoğan.

“Turkish ISPs have set up servers that masquerade as Google’s DNS service,” Google announced on its online security blog.

Google’s DNS resolver provides users an alternative internet “phone book” to one that, for most internet users, is provided by ISPs. The problem with relying on a local ISP’s DNS resolver is that governments can order ISPs to alter that phone book to serve up false IP addresses for blacklisted sites.

That's what Turkey's ISPs appear to have done. Following the initial blockade on Twitter someone in Turkey spray-painted the Google DNS service’s IPv4 addresses — and — on a public wall, suggesting it as a way to bypass the ban.

Other IP addresses that could be used to bypass the blockade were BGPMon’s OpenDNS address and Level 3’s addresses and

People looking to get around the blockade could change their devices’ DNS settings to those services to avoid local operators, under government instruction, providing them with incorrect IP addresses for the banned sites.

While Turkish ISPs are the behind the DNS service intercept, it would appear they're doing it against their own business interests.

“The government did not instruct [Turkish ISPs] to block Google or Level 3 DNS servers… The government told them to block Twitter and then YouTube. The providers are seemingly trying to implement the ban in small incremental steps that still satisfy the letter of the law,” wrote Emil Zmijewski, VP and general manager of network intelligence provider Rensys.

According to BGPMon’s founder, Andree Toonk, the fake DNS servers that Turkish ISPs are using to intercept their traffic appear to have been designed in a way lets them comply with the Turkish government’s blockade without breaking internet connectivity for Turkish users.

“Instead of null routing this IP address [Turk Telekom] brought up servers with the IP addresses of the hijacked DNS servers and are now pretending to be these DNS servers,” Toonk explained.

“These new fake servers are receiving traffic for and other popular DNS providers and are answering DNS queries for the incoming DNS requests. One of the possible reasons for impersonating these DNS providers instead of just null routing traffic to these DNS providers is that they did not want to break Internet connectivity for the significant number of Turkish users that are using these popular DNS servers.”

According to Toonk, the fake Google DNS server on returns the IP address

“This IP is a machine on Turk Telekom and not a real Youtube server. Interestingly the returned IP is the same IP address where we’ve seen Twitter.com traffic for users in Turkey redirected to since last week.”

Reneys’ Zmijewski also confirmed the server in question was returning the same IP address for users in Turkey attempting to access YouTube. 

“Now when Turkish users seemingly ask a Google DNS server for YouTube’s address, they get the IP address of a Turkish government site (, explaining the ban,” said Zmijewski.

This article is brought to you by Enex TestLab, content directors for CSO Australia.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags social mediacybercrimeGoogleDNShijacking trafficGoogle DNS service

More about CSOEnex TestLabGoogle

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Brand Page

Stories by Liam Tung

Latest Videos

More videos

Blog Posts