Because GitHub is blocked in Iran, Champa distributes binaries through three alternative channels: a Telegram bot (@getchampabot), Google Drive folders, and curl commands documented in the GitHub issue thread itself. The issue thread remains accessible via Google cache / AMP even when GitHub's domain is blocked, creating a bootstrapping loop.

Champa implements adaptive request-rate control: when the AMP cache returns an unexpected response (e.g., HTTP 302), the client halves its polling rate. Once the polling interval exceeds one second the client is considered fully rate-limited and must restart after a multi-hour cooldown. This mechanism keeps the client from burning through its allowance when cache responses degrade.

Troubleshooting section defense

Champa's AMP-cache tunnel delivers at most ~15 KB/s throughput before AMP rate-limiting activates. Sessions last approximately 15 minutes before the rate limit triggers; after that, users must stop the client and wait several hours before resuming.

Issue body (rate-limit description) evaluation

As of June 2025, Iran blocks GitHub.com and Telegram but leaves the IP address of google.com reachable and Google Drive accessible. This selective blocking pattern created the operational window for Champa: because google.com is reachable, its AMP cache (cdn.ampproject.org) can be reached by fronting on that IP, then used to proxy connections to otherwise-blocked destinations.

Issue body (opening description) deployment

Champa routes connections by specifying an AMP cache URL (https://cdn.ampproject.org/) with google.com as the front domain, then uses the SOCKS5 proxy interface locally. The server's public key is hardcoded in the connection string, providing a fixed authentication token that prevents trivial impersonation of the proxy by a censor injecting a fake server response during active probing.

Setup section (§2) defense

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

Internal Jira tickets reveal that Psiphon lacked obvious protocol signatures, forcing censors to fall back to IP-based blocking of Psiphon3 client IPs combined with a 'whitelist protection mechanism' that allows traffic when the destination SNI matches a popular domain—an explicit collateral-damage tradeoff documented in the Confluence file 'GTN498 The collateral damage analysis of Psiphon3 Blocking.' A ticket from the Ethiopia (E21) deployment shows customers complaining that the VPN deny policy inadvertently blocked non-VPN applications.

2026-ablove-technical-analysis-geedge §4.1.2, Figure 2, Figure 3 ip-blockingsni-blocking

IPv6 does not inherently worsen fingerprinting privacy: dual-stack complete sites are measurably harder to fingerprint via IPv6 (45%) than IPv4 (56%), contrary to community fears. The key driver is not the protocol but hosting provider behavior—Cloudflare, Google, and Fastly co-locate large clusters of domains behind a small set of shared IPv6 addresses, creating structured similarity clusters that reduce classifier separability, while Amazon allocates domains across vast unique IPv6 prefixes, increasing fingerprintability.

2026-ahmad-more-space-less §7.1, §6.1, §6.2 website-fingerprintip-blocking

Across three testers all on MTS, whitelist behavior varied by network segment in ways that could not be explained by protocol configuration alone; the operator has zero confirmed data for MegaFon, Beeline, or T2 under whitelist conditions. The open question of whether whitelist policy (site+IP list) is centrally issued by the Ministry of Digital Development while implementation differs per carrier remains unresolved, making cross-carrier generalization of any circumvention finding unreliable.

2026-amigocarra-bypassing-russian-federation-s Issue body — questions 1 and 2 ip-blockingsni-blocking

During apparent whitelist-activation periods on MTS mobile LTE, the affected user experienced a complete network blackout in which even explicitly whitelisted resources (gosuslugi.ru) were inaccessible — behavior inconsistent with a standard default-deny CIDR+SNI whitelist, which should pass approved destinations unconditionally. The operator concludes this may represent a stricter enforcement variant, a SIM-specific restriction, or a mechanism entirely separate from the documented whitelist architecture.

2026-amigocarra-bypassing-russian-federation-s Issue body — main mystery paragraph ip-blockingsni-blocking