If it's Hurricane Electrics tunnel I've had similiar issues, I think they use Russian blocks for their IPv6 tunnel since the abuse potential is so high and they don't want to deal with it so they just bundle all their shit with Russia and move on.

Yep, it is HE tunnel. Nice to know that I'm not alone.

maybe you actually have a MITM proxy stealing all of your traffic and keystrokes

MITM for HTTPS? I don't think so!