Community testing in Iran following the fragmentation bypass failure confirms that REALITY and Shadowsocks remain viable circumvention mechanisms as of late July 2026. Neither protocol relies on ClientHello fragmentation for evasion, which accounts for their continued functionality under the updated Iranian filtering regime.

Iran's censorship infrastructure began dropping all fragmented TLS ClientHello packets around late July 2026, rendering the tlshello fragmentation bypass technique non-functional. The blocking took effect approximately July 27, 2026, based on user-reported timelines in the net4people/bbs community report.

Issue body (Jul 31 2026) detection

Iran's fragmentation-detection capability targets the fragmentation mechanism itself, not the SNI field content: testers report blocking occurs even when the fragmented ClientHello carries a clean, non-blocked SNI. This indicates the censor is classifying flows by structural packet properties (fragment boundary patterns) rather than by inspected SNI value.

Issue body (Jul 31 2026) detection

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

TLS ClientHello length-field permutation tests show that GFW II's parsing behavior matches an older tagged version of TSG's SSL module, while Kazakhstan and Pakistan (DROP mode) exhibit parsing behaviors consistent with TSG QUIC plugin deployments. QUIC version fingerprinting further confirms Kazakhstan runs an older version of TSG's QUIC parsing code, and Myanmar's supported QUIC versions exactly match TSG's, spanning at least five countries confirmed or plausibly running TSG components.

2026-ablove-technical-analysis-geedge §6.4, §6.5, Table 8, Table 9 dpitls-fingerprinthttp3-quic-blocksni-blocking

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

VLESS+Reality with uTLS and decoy SNI pointed at popular domains (vk.com, cloudflare.com) bypasses standard DPI blocking on MTS and has operated stably for one real user over several weeks with thousands of connections logged. However, an identical configuration failed to establish a single connection for a second user on the same carrier but in a different network segment (Moscow number vs. regional/southern number), including during periods confirmed to be outside whitelist activation.

2026-amigocarra-bypassing-russian-federation-s Issue body — confirmed working / not working sections dpisni-blockingip-blocking

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.

2026-article19-tightening-the-net §4, §5 dpisni-blockingthrottling