Comparative analysis of 73 unmatched events (2022 onward) between IODA's automated network-level detection and Access Now's #KeepItOn Shutdown Tracker reveals systematic documentation gaps — shutdowns recorded by human reporters are frequently absent from automated measurement platforms and vice versa.

Application-layer blocking — where censors restrict specific applications or services without disrupting IP connectivity — is invisible to network-level measurement systems like IODA that monitor BGP, active probing, darknet telescope, and Google Search traffic, making it a growing blind spot in automated shutdown detection.

Abstract / §3 Detection Gap Categories evaluation

AS-targeted shutdowns — where censors restrict connectivity at specific ISPs or autonomous systems rather than imposing country-wide outages — evade country-level aggregation in automated detection systems, which are calibrated to detect national-scope disruptions.

§3 Detection Gap Categories evaluation

Prolonged conflicts with gradual infrastructure recovery represent a third category of detection gap: IODA-style automated systems struggle to distinguish ongoing partial outages from normal network fluctuation, causing recovery-phase disruptions in conflict zones (e.g., Myanmar, Sudan) to go undocumented in automated records.

§3 Detection Gap Categories evaluation

All sampled popular-service prefixes contain at least two TLS-authenticated witnesses, and more than half contain 35 or more witnesses; by contrast, only 40% of randomly selected prefixes feature any valid witnesses. CT log analysis across 5 months shows that witnesses span just 17.4% of the routable IPv4 space, confirming that witness coverage concentrates on professionally-hosted infrastructure.

2026-doumanidis-howlr-client-driven-approach §4 bgp-hijackactive-probing

LZR, built on top of ZMap, can identify 99% of unexpected Internet services in five handshakes by acting as a shim between ZMap and ZGrab. This gives censors and researchers alike an efficient active-probing primitive to fingerprint proxy protocols at scale.

2024-durumeric-ten-years-zmap LZR tool description active-probingmeasurement-platform

Combining all three active probing attacks in an Internet-wide scan of 30 million HTTPS servers identified approximately 15,000 hosts (0.05%) behaving like ShadowTLS relays; of these only 6,000 presented TLS certificates for Alexa Top 1000 domains. The scan successfully discovered all four researcher-operated ShadowTLS relays planted as ground truth.

2023-wang-chasing §3.2, Table 2 active-probingmeasurement-platform

The authors' ISP Tap dataset yielded 129,000 unique response sets across 433,286 endpoints while ZMap's 1.5 million endpoints produced only 31,000 unique sets — with over 42% of ZMap endpoints behaving identically (infinite timeout, no data) due to firewall chaff. This vantage-point bias means the effective false-positive rate a censor faces when targeting ISP-observed traffic is ~28× lower than against random scans (0.02% vs 0.56% for MTProto), making ISP-scale active probing far more actionable than Internet-wide scanning alone.

2020-frolov-detecting §III-B, §V-D, Fig. 2 active-probingmeasurement-platform

Encore's architecture turns ordinary web visitors into measurement vantage points, which the researchers argue prevents censors from detecting and disabling dedicated measurement probes. However, this benefit comes with the trade-off that the individuals whose browsers are co-opted face potential legal or physical risk that differs by country and by the specific censored content accessed.

2015-narayanan-no Background / Analysis measurement-platformactive-probing

In the August 2012 Bell-Dery BGP route leak, TTL analysis at per-prefix granularity revealed that two IP addresses within AS577 maintained constant TTLs and unaffected packet rates throughout the disruption, while 37 of 38 other active /16 prefixes experienced significant volume drops and TTL changes indicating rerouting through longer paths. This demonstrates that BGP route leaks can affect subnets within a single AS asymmetrically, and that TTL inspection can identify unaffected sub-AS paths.

2013-benson-gaining §IV-B bgp-hijackmeasurement-platform