VLESS+Reality with uTLS and decoy SNI pointed at popular domains (vk.com, cloudflare.com) bypasses standard DPI blocking on MTS and has operated stably for one real user over several weeks with thousands of connections logged. However, an identical configuration failed to establish a single connection for a second user on the same carrier but in a different network segment (Moscow number vs. regional/southern number), including during periods confirmed to be outside whitelist activation.

Across three testers all on MTS, whitelist behavior varied by network segment in ways that could not be explained by protocol configuration alone; the operator has zero confirmed data for MegaFon, Beeline, or T2 under whitelist conditions. The open question of whether whitelist policy (site+IP list) is centrally issued by the Ministry of Digital Development while implementation differs per carrier remains unresolved, making cross-carrier generalization of any circumvention finding unreliable.

Issue body — questions 1 and 2 evaluation

During apparent whitelist-activation periods on MTS mobile LTE, the affected user experienced a complete network blackout in which even explicitly whitelisted resources (gosuslugi.ru) were inaccessible — behavior inconsistent with a standard default-deny CIDR+SNI whitelist, which should pass approved destinations unconditionally. The operator concludes this may represent a stricter enforcement variant, a SIM-specific restriction, or a mechanism entirely separate from the documented whitelist architecture.

Issue body — main mystery paragraph detection

Community-maintained public CIDR lists of Russian mobile whitelist ranges allow operators to identify specific whitelisted IP blocks within cloud providers: a /22 subnet inside Yandex Cloud's /16 pool appears on these lists, while the ephemeral addresses from a different /20 pool of the same provider do not. Reserving a static IP from the whitelisted /22 allows the Reality handshake to complete and traffic to proxy from external vantage points, though in-whitelist passage on a real mobile device remained unconfirmed at time of writing.

Issue body — Yandex Cloud architecture paragraph deployment

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

As of June 2026, Iranian DPI blocking timescales are: CDN-fronted VLESS+WebSocket domains blocked within 24 hours; SSH dynamic port forwarding server IPs blocked within 8 hours; Reality and WireGuard connections blocked immediately (seconds) after handshake completion. This graduated timeline suggests separate fast-path (handshake-pattern) and slow-path (domain reputation / traffic accumulation) detection pipelines operating in parallel.

2026-pooribitwise-iran-advanced-dpi Issue body — combined observations dpisni-blockingip-blockingrst-injectiondns-poisoning

Iran's DPI blocks VLESS/WS traffic routed through Cloudflare CDN in full-strict TLS mode with regularly rotated clean Cloudflare IPs, demonstrating that CDN-fronted traffic is not opaque to the censor and that IP-layer evasion (using clean CDN IPs) is insufficient when the SNI is fingerprinted.

2026-pooribitwise-iran-advanced-dpi Description dpisni-blockingip-blocking

The GNL reveals that Geedge actively maintains dedicated VPN-infrastructure tracking datasets. The China-specific component includes 7,016 domains in a "vpn-finder-plugins" repository (mesalab_git/intelligence-learning-engine), 4,810 NordVPN server domains, and a Pakistan-specific file listing 68 Psiphon CDN domains (geedge_docs/TSGEN/.../Psiphon-CDN_20240430.json) dated April 2024. A Myanmar deployment file (M22-VPN List.html, 27 domains) further confirms country-specific VPN blocklists are operationally maintained. The "Appsketch" program reverse-engineers VPN apps to extract domains and IP addresses for blocking.

2026-sheffey-geedge §4.2, Table 3 dpisni-blockingip-blocking

Amnesty International's 102-page investigation identifies a multi-vendor surveillance stack deployed in Pakistan: Chinese DPI (Geedge/MESA-derived), Canadian social-media monitoring (Netsweeper), and Emirati commercial spyware (Pegasus and FinFisher). The system enables deep packet inspection, SNI-based filtering, and traffic-shape classification at national scale, including targeted interception of encrypted messaging apps and VPN traffic.

2025-amnesty-pakistan-shadows §3, §5 dpisni-blockingip-blockingtraffic-shapeml-classifier