AS-targeted shutdowns — where censors restrict connectivity at specific ISPs or autonomous systems rather than imposing country-wide outages — evade country-level aggregation in automated detection systems, which are calibrated to detect national-scope disruptions.

Comparative analysis of 73 unmatched events (2022 onward) between IODA's automated network-level detection and Access Now's #KeepItOn Shutdown Tracker reveals systematic documentation gaps — shutdowns recorded by human reporters are frequently absent from automated measurement platforms and vice versa.

Abstract / §1 Introduction evaluation

Application-layer blocking — where censors restrict specific applications or services without disrupting IP connectivity — is invisible to network-level measurement systems like IODA that monitor BGP, active probing, darknet telescope, and Google Search traffic, making it a growing blind spot in automated shutdown detection.

Abstract / §3 Detection Gap Categories evaluation

Prolonged conflicts with gradual infrastructure recovery represent a third category of detection gap: IODA-style automated systems struggle to distinguish ongoing partial outages from normal network fluctuation, causing recovery-phase disruptions in conflict zones (e.g., Myanmar, Sudan) to go undocumented in automated records.

§3 Detection Gap Categories evaluation

Unsolicited background radiation traffic to the UCSD network telescope—particularly Conficker worm scanning (TCP SYN, port 445, 48-byte packets)—dropped nearly simultaneously with Egyptian BGP route withdrawals on January 27, corroborating control-plane analysis with data-plane evidence. Crucially, some worm-infected hosts continued to generate outbound scanning traffic even after their prefixes were BGP-withdrawn, because packet filtering was absent; this asymmetry between inbound unreachability and outbound connectivity can distinguish pure BGP-based blocking from combined BGP-plus-filtering approaches.

2011-dainotti-analysis §4.3, §5.1 bgp-hijackasn-blackholingmeasurement-platform

The paper demonstrates that two protocol-specific censorship changes — QUIC blocking reaching 100% and DNS-over-TCP blocking reaching 96.68% — both occurred in the scan conducted immediately before Iran's June 18 full blackout, and that similar shutdown preparations were also documented before Iran's January 2026 shutdown. The authors hypothesize that continuous long-term measurement of protocol-specific censorship rates could provide advance warning of impending shutdowns before they come into full effect.

2026-anon-insights-into-iranian §3, §4 http3-quic-blockdns-poisoningmeasurement-platform

A code-level audit of 737 Chrome VPN and proxy browser extensions found that 520 of 522 sampled packages routed all non-loopback browsing traffic to a single shared SOCKS5 infrastructure; 274 of the 737 impersonated 66 known VPN or privacy brands across at least 40 developer accounts, and 516 of the identified extensions remained live in the Chrome Web Store at the time of data collection.

2026-anon-vpn-ai-deepseek §免费VPN扩展的核心问题 measurement-platform

Chrome Web Store metrics—including cumulative installation display counts totaling 75,486, five-star ratings, and brand-similar icons—provided no reliable signal of proxy operator trustworthiness among the 737 identified malicious VPN extensions; 516 remained listed throughout the study period despite routing traffic to a shared centralized infrastructure.

2026-anon-vpn-ai-deepseek §免费VPN扩展的核心问题 measurement-platform

Brussee measures a systematic pattern of Chinese government websites actively blocking access from outside China (the "reverse Great Firewall"), publishing a CSV dataset of affected domains (available at zenodo.org/records/18172145). The paper frames this outbound geo-blocking as a cybersecurity-motivated practice — Chinese authorities classify foreign access to domestic government infrastructure as an attack surface — distinct from the inbound information control goal of the GFW.

2026-brussee-reverse-great-firewall §3, §5 ip-blockingasn-blackholing

Brussee develops a conceptual framework distinguishing two logics of government geo-blocking: (1) information control (blocking inbound foreign content from domestic users) and (2) data sovereignty / attack-surface reduction (blocking outbound access by foreign actors to domestic systems). Chinese government site blocking of external IPs is motivated primarily by the second logic, creating an asymmetric internet topology where CN citizens cannot reach the outside world, and outside actors cannot probe CN government infrastructure.

2026-brussee-reverse-great-firewall §2, §4 ip-blockingasn-blackholing