11 min read
A blocked site opens without a VPN when your request has slipped past the filter. In Russia there are two filters: the carrier's own, which checks against Roskomnadzor's registry, and TSPU (ТСПУ, "technical means of countering threats"), the regulator's equipment installed in the carrier's network. They aren't on every route, they work differently, and they sometimes fail. That's why the same site opens for your neighbor on a different carrier, on mobile internet, in an app, or simply today, and tomorrow it's gone again.
The reason is almost always the route, not that the block has been lifted. The request went through a different DNS server, a different network or a different protocol, or it hit a moment when the filter didn't trigger. Restrictions are sometimes officially lifted too, but that's easy to check.
| What happened | What it looks like | For how long |
|---|---|---|
| The site was removed from the registry | Opens on all carriers and all devices | Yes, for good |
| The carrier blocks only via DNS | Opens after changing the DNS in the browser or phone | Until the filter is changed |
| The filter is weaker on your route | Works on one carrier and not on another | Unpredictable |
| TSPU failure or shutdown | Suddenly works for many people, then gets slow again a few days later | Days |
| The app takes a different path | Works in the app but not in the browser | Until the filter is updated |
| Browser or app cache | The old feed is visible, nothing new loads | Minutes |
| Throttling instead of blocking | The site opens partially, without images and video | While the restriction is in effect |
If you need access that doesn't depend on which route your request takes today, we recommend BessyConnect: its protocol disguises traffic as ordinary HTTPS.
Blocking starts with an entry in Roskomnadzor's unified registry. Under Part 10 of Article 15.1 of Federal Law 149-FZ, a telecom operator must restrict access to a site within 24 hours of its inclusion in the registry. Technically, this is done by two different mechanisms.
The first mechanism is the carrier's own filter. It downloads the registry and responds to requests for prohibited addresses with a block page. The second is TSPU. Under Clause 5.1 of Article 46 of the Law "On Communications", the carrier must ensure TSPU is installed at nodes with data rates above 10 Gbit/s. If traffic is filtered centrally through TSPU, the carrier isn't required to restrict access itself. More about this equipment is in the article TSPU: what it is and how filtering works.
What this looks like in practice was shown by a study by researchers at the University of Michigan and their co-authors, "TSPU: Russia's Decentralized Censorship System" (IMC conference, October 2022). The authors found more than a million addresses in 650 networks sitting behind TSPU. In 70% of cases the device is no more than two hops from the end address, meaning very close to the subscriber. At the time, TSPU blocked by the site name at the start of a secure connection (SNI), by IP address and by the QUIC protocol. Why the site name is visible even in HTTPS is explained in the article SNI and ECH: how sites are blocked by name.
The most telling figure from the same study concerns the difference between the filters. The researchers took 10,000 domains added to the registry since January 1, 2022. The DNS servers of Rostelecom and OBIT returned a block page for only 1,302 and 3,943 of them. TSPU in the same networks blocked 9,655 domains. One registry, but two filters with very different coverage.
Because different carriers, regions and connection types have different paths to the site and different filters along those paths. Home internet and mobile internet from the same carrier can also behave differently.
Examples from recent years:
Video has an additional cause: caching inside the network. Google Global Cache, according to Google's help center, lets an ISP serve some Google content from its own servers. A video from such a cache and a video coming from abroad travel different paths, so video may load on one carrier and not on another.
Filters change, break and get fixed without announcements. If a site suddenly starts working for many people at once, most often it's a temporary shutdown or an equipment failure, not a decision to lift the block.
In November 2024, Habr described a typical story. The monitoring service GlobalCheck showed YouTube as fully accessible again, and many people wrote "YouTube is working on all carriers". A few days later videos started loading slowly again. Commenters linked the brief "clearing" to TSPU being temporarily switched into a mode that passed traffic without filtering. No one officially confirmed this.
There are also one-off misses. In the 2022 study, TSPU let through anywhere from fractions of a percent up to 2.19% of the requests it should have blocked, depending on the network and the blocking type. Where there were two devices on the path, there were fewer misses: a failure has to coincide on both. Hence the common situation: the page opened once, you refreshed it, and it was gone.
It works in the opposite direction too. New addresses are added to the registry, and the carrier has 24 hours to apply the entry. A site that opened freely yesterday may be filtered today.
The app and the browser reach the same service by different paths: through different addresses, protocols and DNS. The filter may block one path and let the other through.
Here's what differs:
A special case is partial loading. On June 26, 2025, Cloudflare reported that since June 9, 2025, Russian ISPs, including Rostelecom, MegaFon, Vimpelcom, MTS and MGTS, had been letting through only the first 16 KB of each file from its servers. The page starts to open, but images, scripts and video get cut off. This is a restriction, not a site failure.
The check takes a few minutes:
If a site only opens via a lucky route, you can't rely on it. What really works without a tunnel and where you need one is collected in the article how to get by without a VPN: what works and what doesn't.
With a VPN, access doesn't depend on which filter your carrier has or whether it triggered today. All traffic goes through a single encrypted connection to a server beyond the filter. What matters is that the tunnel itself isn't recognized: according to the 2022 study, TSPU identifies protocols by characteristic bytes at the start of packets, which is exactly how it detected QUIC.
What BessyConnect offers:
Download the app:
The app isn't in the Russian App Store: to install it on iPhone you need an Apple ID from another country.
The honest limit. A VPN won't help if mobile internet has been switched to whitelists: the tunnel has nothing to connect to; details are in the article does a VPN help when mobile internet is shut off. It won't bring back a site that has gone down on its own or that blocks users from Russia on its side. And it doesn't change the rules: what's allowed and what's prohibited is covered in the article is a VPN legal in Russia.
If a site opens for you sometimes and sometimes not, don't chase a lucky route. Install BessyConnect from the download page and test it on your carrier during the trial period.
Why does Instagram work without a VPN? Usually because of the route: a different network, a different DNS server or a temporary filter failure. In October 2022 this happened for some MTS and MegaFon subscribers on mobile internet, and the Hi-Tech Mail editors warned right away that the access was temporary.
How can I find out whether a site is officially blocked? Enter the address in Roskomnadzor's service blocklist.rkn.gov.ru. It will show whether access to that address is restricted under the registry. Absence from the registry doesn't guarantee the filter leaves the site alone.
Does changing DNS help open a blocked site? Only if your carrier blocks the site via DNS. TSPU sees the site name in the connection itself, and changing DNS doesn't work against it.
Why does a site open, but without images and video? Most often it's throttling, not a broken site. In June 2025 Cloudflare reported that Russian ISPs let through only the first 16 KB of each file from its servers, so images and video get cut off.
Is BessyConnect suitable if a site only opens every other time? Yes. BessyConnect runs on VLESS with Reality camouflage, and the connection looks like ordinary HTTPS, so access doesn't depend on filter failures along your route. If mobile internet has been switched to whitelists, no VPN will help.
BessyConnect is a VPN for Telegram: restore chats and calls when Telegram isn't working. The VLESS+Reality protocol bypasses blocks and DPI on all devices. More
BessyConnect is a VPN for WhatsApp that restores voice and video calls when they're blocked. The VLESS + Reality protocol beats DPI. Get it for iOS and Android. More
BessyConnect is a VPN for Discord: get into Discord when it's blocked and restore voice, streams and screen sharing on PC and mobile. VLESS+Reality beats DPI. More
