Malicious VPN browser extensions using chrome.proxy.settings route all browser requests through an operator-controlled SOCKS5 proxy, giving that operator direct visibility into source IP, connection destinations, TLS SNI hints, and cleartext HTTP content. For HTTPS destinations the payload is not readable, but connection metadata, access patterns, and DNS queries remain exposed at the proxy layer regardless of in-tunnel encryption.

A code-level audit of 737 Chrome VPN and proxy browser extensions found that 520 of 522 sampled packages routed all non-loopback browsing traffic to a single shared SOCKS5 infrastructure; 274 of the 737 impersonated 66 known VPN or privacy brands across at least 40 developer accounts, and 516 of the identified extensions remained live in the Chrome Web Store at the time of data collection.

§免费VPN扩展的核心问题 evaluation

Researchers replayed opaque 'reasoning block' objects from 6,708 publicly posted LLM agent interaction traces against weaker models from the same AI provider, decoding 315,320 blocks and recovering 367 personally identifiable information items and 182 credentials; the attack demonstrates that scrubbing human-readable text from shared agent logs does not prevent leakage of secrets embedded in provider-internal API state objects.

§Agent日志泄密 evaluation

Chrome Web Store metrics—including cumulative installation display counts totaling 75,486, five-star ratings, and brand-similar icons—provided no reliable signal of proxy operator trustworthiness among the 737 identified malicious VPN extensions; 516 remained listed throughout the study period despite routing traffic to a shared centralized infrastructure.

§免费VPN扩展的核心问题 evaluation

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

Iran's DPI infrastructure performs full TCP reassembly and stateful inspection on the fly, nullifying TCP fragmentation (10–30 byte fragments with 10–20ms delays) applied to VLESS+WebSocket behind Cloudflare CDN in full-strict mode. Domains are blocked within 24 hours despite the CDN layer and rotation of clean Cloudflare IPs. Fragmentation was applied to the first 5 packets and verified correct on the client side with tcpdump; the setup used port 443 with a randomized WebSocket path.

2026-pooribitwise-iran-advanced-dpi Issue body — Description / The Issue dpisni-blockingtraffic-shape

Iran's fragmentation-detection capability targets the fragmentation mechanism itself, not the SNI field content: testers report blocking occurs even when the fragmented ClientHello carries a clean, non-blocked SNI. This indicates the censor is classifying flows by structural packet properties (fragment boundary patterns) rather than by inspected SNI value.

2026-spiderxss-tlshello-fragmentation-not Issue body (Jul 31 2026) dpisni-blockingtraffic-shape

Amnesty International's 102-page investigation identifies a multi-vendor surveillance stack deployed in Pakistan: Chinese DPI (Geedge/MESA-derived), Canadian social-media monitoring (Netsweeper), and Emirati commercial spyware (Pegasus and FinFisher). The system enables deep packet inspection, SNI-based filtering, and traffic-shape classification at national scale, including targeted interception of encrypted messaging apps and VPN traffic.

2025-amnesty-pakistan-shadows §3, §5 dpisni-blockingip-blockingtraffic-shapeml-classifier

Internal Geedge documents confirm active contracts to deploy GFW-derived censorship and surveillance infrastructure in Myanmar, Pakistan, Ethiopia, Kazakhstan, and at least one additional unidentified country under the Belt and Road framework, in addition to domestic deployments in Xinjiang, Jiangsu, and Fujian. The exported product (the Tiangou Secure Gateway / TSG line) is not a stripped-down export variant — leaked TSG documentation shows DPI, active-probing, ML classifiers, and granular per-region traffic control rules that mirror the domestic GFW capability set.

2025-geedge-mesa-leak §5, §6 dpiactive-probingml-classifiersni-blockingdns-poisoningfully-encrypted-detecttraffic-shape