Iran's June 2025 shutdown was enforced using fine-grained, service-level techniques rather than BGP withdrawals or a single 'big switch' event: individual protocols were selectively blocked before and after the 7-day full blackout (June 18–25), with the total preparation and recovery periods each lasting roughly 4–5 days. Cloudflare Radar showed HTTP traffic reaching near-zero by June 18 but partial recovery already on June 21, while the authors' vantage point (AS57497) remained unreachable until June 25, confirming heterogeneous recovery across Iranian networks.

HTTP censorship blockpages in Iran fell into two distinct clusters distinguished by IP TTL values: type NTL1 (TTL 53–55) and type NTE1 (TTL 186–188); TCP RST injections targeting TLS and DNS-over-TCP exhibited the same two TTL ranges. The NTL1 injector was absent on June 11 but present on other days, leading the authors to conclude that an entire injector went offline rather than that a single injection pattern was selectively disabled.

§2.2.5 detection

After the shutdown lifted (Scan 3), DNS-over-UDP degraded severely — 89.18% of the 9,000 queried domains were affected — but the paper attributes this to general UDP transport instability rather than domain-specific censorship, corroborated by GitHub user reports of ongoing UDP issues. TCP-based protocols (HTTP, TLS) returned to pre-shutdown censorship levels (~15%) in Scan 3, confirming the post-shutdown persistence effect was UDP-specific and not a broadening of the blocklist.

§2.2.4, Table 1 evaluation

In the pre-shutdown scan (Scan 2), Iran's QUIC censorship jumped from 1 domain (0.01%) to 9,000 domains (100%) via complete UDP Initial-packet drops, while DNS-over-TCP censorship spiked from 15.12% to 96.68% of 9,000 queried domains. Both changes preceded the full blackout by roughly 5 days, indicating they were preparatory measures rather than incidental. After the shutdown lifted, QUIC remained 100% blocked while DNS-over-TCP returned to baseline (15.38%).

§2.2, Table 1 evaluation

The paper demonstrates that two protocol-specific censorship changes — QUIC blocking reaching 100% and DNS-over-TCP blocking reaching 96.68% — both occurred in the scan conducted immediately before Iran's June 18 full blackout, and that similar shutdown preparations were also documented before Iran's January 2026 shutdown. The authors hypothesize that continuous long-term measurement of protocol-specific censorship rates could provide advance warning of impending shutdowns before they come into full effect.

§3, §4 evaluation

During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.

2025-iran-shutdown-measurement §Tool Performance dpithrottling

TLS ClientHello length-field permutation tests show that GFW II's parsing behavior matches an older tagged version of TSG's SSL module, while Kazakhstan and Pakistan (DROP mode) exhibit parsing behaviors consistent with TSG QUIC plugin deployments. QUIC version fingerprinting further confirms Kazakhstan runs an older version of TSG's QUIC parsing code, and Myanmar's supported QUIC versions exactly match TSG's, spanning at least five countries confirmed or plausibly running TSG components.

2026-ablove-technical-analysis-geedge §6.4, §6.5, Table 8, Table 9 dpitls-fingerprinthttp3-quic-blocksni-blocking

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.

2026-article19-tightening-the-net §4, §5 dpisni-blockingthrottling

Russia's TSPU devices began dropping all international QUIC traffic on approximately February 26, 2022, coinciding with the full-scale invasion of Ukraine. The filter identified QUIC flows by requiring the first UDP packet destined to port 443 to be at least 1001 bytes and contain the 4-byte QUIC version 1 header (0x00000001); QUIC traffic from Russia to Cloudflare dropped 46% within days. The TSPU maintained 420-second state on the 4-tuple and applied residual censorship to all subsequent packets.

2026-heitmann-russia-s-early-introduction §2.2 http3-quic-blockdpiport-blocking