Iran implemented a near-complete internet shutdown from June 17–26, 2025 using selective IP-based whitelisting: api.github.com and api.google.com remained accessible while the general internet was blocked. IODA measurements confirmed that ASes 44244 (IranCell) and 57218 (RighTel)—the two largest mobile carriers—were nearly unreachable for the duration.

Iranian censors actively detected and blocked circumvention proxies in real time during the June 2025 shutdown: MTProto proxies, v2ray tunnels (VLESS and VMESS variants), and Tor bridges using both Snowflake and obfs4 all experienced mixed or degraded success as proxies were identified and blocked.

Abstract / community testing thread detection

The June 2025 Iran shutdown lasted 10 days (June 17–26) and generated real-time community measurement via IODA and crowdsourced circumvention testing, establishing this event as primary-source documentation of simultaneous carrier-level BGP suppression and application-layer proxy blocking—a dual-layer shutdown strategy distinct from typical content-level filtering.

Issue metadata / abstract evaluation

During Iran's June 2025 shutdown, early reports indicated TCP connections were broadly blocked while UDP-based proxies (Telegram MTProto over UDP) could still establish sessions, suggesting the initial blocking rule targeted TCP at the transport layer rather than applying protocol-agnostic packet filtering.

Issue body (Edit1 / initial reports) evaluation

Brussee measures a systematic pattern of Chinese government websites actively blocking access from outside China (the "reverse Great Firewall"), publishing a CSV dataset of affected domains (available at zenodo.org/records/18172145). The paper frames this outbound geo-blocking as a cybersecurity-motivated practice — Chinese authorities classify foreign access to domestic government infrastructure as an attack surface — distinct from the inbound information control goal of the GFW.

2026-brussee-reverse-great-firewall §3, §5 ip-blockingasn-blackholing

Brussee develops a conceptual framework distinguishing two logics of government geo-blocking: (1) information control (blocking inbound foreign content from domestic users) and (2) data sovereignty / attack-surface reduction (blocking outbound access by foreign actors to domestic systems). Chinese government site blocking of external IPs is motivated primarily by the second logic, creating an asymmetric internet topology where CN citizens cannot reach the outside world, and outside actors cannot probe CN government infrastructure.

2026-brussee-reverse-great-firewall §2, §4 ip-blockingasn-blackholing

The dominant enforcement mechanism in April 2026 was administrative 'reporting + line-cutting' (通报 + 拔线) backed by MIIT bulletins, not protocol-level DPI changes. Operators reported that newly acquired upstream resources were reported to authorities quickly after acquisition, recovery timelines were uncontrollable, and some upstream providers refused refunds after enforcement actions, producing sustained capacity contraction across the shared VPN-reseller ecosystem.

2026-ermao-april-airport-outage §这轮波动到底发生了什么 ip-blockingasn-blackholing

The April 2026 enforcement cycle created a resource-scarcity feedback loop: upstream providers cut lines with no obligation to refund resellers, newly acquired replacement resources can themselves be reported and cut within days, and stable-resource availability windows are described as "越来越短" (increasingly short) while costs rise concurrently. The overall effect is systemic capacity contraction forecast to continue through at least May 2026.

2026-ermao-april-airport-outage §这轮波动到底发生了什么 / §四月后的趋势判断 ip-blockingasn-blackholingthrottling

Transit/relay architectures (国内入口 + 海外转发) suffered disproportionate impact because multiple nodes share a single domestic entry point: when that entry is reported or cut, the entire batch of nodes fails simultaneously. Operators described this as "三线变单线" (three-line to single-line collapse), with only direct-connect fallback remaining — at higher latency and with worse peak-hour performance.

2026-ermao-april-airport-outage §为什么中转机场这次受冲击更明显 ip-blockingasn-blackholing

CensorLess's threat model explicitly relies on a rational-censor assumption: the censor will not block entire cloud-provider IP ranges or domain namespaces because the collateral damage to legitimate business services would be politically and economically unacceptable. AWS Lambda's inherent IP-address ephemerality (new IPs on each invocation, function lifetime up to 15 minutes) means even censors willing to attempt enumeration face a continuously shifting target distributed across the cloud provider's global address space.

2026-kang-censorless-serverless §4.2 ip-blockingasn-blackholingactive-probing