Community-maintained public CIDR lists of Russian mobile whitelist ranges allow operators to identify specific whitelisted IP blocks within cloud providers: a /22 subnet inside Yandex Cloud's /16 pool appears on these lists, while the ephemeral addresses from a different /20 pool of the same provider do not. Reserving a static IP from the whitelisted /22 allows the Reality handshake to complete and traffic to proxy from external vantage points, though in-whitelist passage on a real mobile device remained unconfirmed at time of writing.

Across three testers all on MTS, whitelist behavior varied by network segment in ways that could not be explained by protocol configuration alone; the operator has zero confirmed data for MegaFon, Beeline, or T2 under whitelist conditions. The open question of whether whitelist policy (site+IP list) is centrally issued by the Ministry of Digital Development while implementation differs per carrier remains unresolved, making cross-carrier generalization of any circumvention finding unreliable.

Issue body — questions 1 and 2 evaluation

During apparent whitelist-activation periods on MTS mobile LTE, the affected user experienced a complete network blackout in which even explicitly whitelisted resources (gosuslugi.ru) were inaccessible — behavior inconsistent with a standard default-deny CIDR+SNI whitelist, which should pass approved destinations unconditionally. The operator concludes this may represent a stricter enforcement variant, a SIM-specific restriction, or a mechanism entirely separate from the documented whitelist architecture.

Issue body — main mystery paragraph detection

VLESS+Reality with uTLS and decoy SNI pointed at popular domains (vk.com, cloudflare.com) bypasses standard DPI blocking on MTS and has operated stably for one real user over several weeks with thousands of connections logged. However, an identical configuration failed to establish a single connection for a second user on the same carrier but in a different network segment (Moscow number vs. regional/southern number), including during periods confirmed to be outside whitelist activation.

Issue body — confirmed working / not working sections evaluation

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

Internal Jira tickets reveal that Psiphon lacked obvious protocol signatures, forcing censors to fall back to IP-based blocking of Psiphon3 client IPs combined with a 'whitelist protection mechanism' that allows traffic when the destination SNI matches a popular domain—an explicit collateral-damage tradeoff documented in the Confluence file 'GTN498 The collateral damage analysis of Psiphon3 Blocking.' A ticket from the Ethiopia (E21) deployment shows customers complaining that the VPN deny policy inadvertently blocked non-VPN applications.

2026-ablove-technical-analysis-geedge §4.1.2, Figure 2, Figure 3 ip-blockingsni-blocking

IPv6 does not inherently worsen fingerprinting privacy: dual-stack complete sites are measurably harder to fingerprint via IPv6 (45%) than IPv4 (56%), contrary to community fears. The key driver is not the protocol but hosting provider behavior—Cloudflare, Google, and Fastly co-locate large clusters of domains behind a small set of shared IPv6 addresses, creating structured similarity clusters that reduce classifier separability, while Amazon allocates domains across vast unique IPv6 prefixes, increasing fingerprintability.

2026-ahmad-more-space-less §7.1, §6.1, §6.2 website-fingerprintip-blocking

LetsVPN (快连) announced termination of China mainland operations on April 28, 2026, stating the team had attempted adjustments 'almost every hour' for 20 days before concluding the connectivity problem was unsolvable. A follow-up announcement on May 8 declared 'resumption of global standard operations' but explicitly stated it could not guarantee China mainland availability.

2026-anon-2026-27-vpn §3 (快连 / LetsVPN section) ip-blockingdpi

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

2026-anon-2026-27-vpn §5 (Human Rights Watch section) port-blockingdpiip-blocking