This guy who did this is from Russia. Last week he attacked only Russian routers and hijack DNS records to google-analytics and yandex.metrika (popular Russian analytics). We found him and shut down his servers, and even had a talk with him. He swore he won't do this again.

http://tjournal.ru/paper/antisanctions-safari-yandex-browser https://gist.github.com/ValdikSS/2706f643bbfa0bb5158f