- anti-censorship-alerts - lists.torproject.org

[CENSORSHIP ALERT] Detailed technical proposal for "intelligent and stable internet censorship" from Iranian government entity – including NAT-based censorship – requesting analysis and circumvention support
by Finch 19 Apr '26

19 Apr '26

Dear Tor Anti-Censorship Team, I am writing to share a sensitive technical document that I believe will be valuable for your work on censorship circumvention. What I am attaching / including: I have obtained a technical proposal prepared for Iranian government entities, including the Supreme Council of Cyberspace and the Communications Infrastructure Company. The document (in Persian) is titled: "Proposed Model for Phased Opening of Vital Keys in the Design and Implementation of Intelligent and Stable Internet Censorship" What the document describes: The proposal outlines a four-phase censorship model, including technical details on: Phase 1: Reducing limitations on domestic apps and services — including DPI (Deep Packet Inspection) using behavioral and signature-based detection, file transfer restrictions (5 MB per session), mandatory server-side scanning, entropy-based traffic monitoring, and packet size distribution analysis. Phase 2: Whitelisting vital websites — using combinations of FQDN, IP prefixes, and ports; domain fronting; AnyCast CDNs; targeted whitelisting first on mobile operators (48-hour monitoring) before fixed-line operators; forcing all resolvers to use national DNS and blocking DoH/DoT to third parties. Phase 3: Opening AI platforms (e.g., ChatGPT) — including how they successfully blocked ChatGPT by creating a custom signature based on handshake patterns, initial sequence numbers, and entropy of Cloudflare WARP traffic; recommendation to only open after custom signature development and two-factor authentication for users. Phase 4: Gradual opening of network protocols — blocking UDP, IPv6, and ICMP tunneling (6to4, Teredo); rate-limiting ICMP; inspecting extension headers; using machine learning for anomaly detection. The document also includes "crisis mode" procedures (full blocking of UDP, IPv6, ICMP; stopping all file uploads without authentication) and "exit from crisis" phased reopening. Important additional detail not explicitly in the letter but part of their implementation strategy: They are implementing NAT-based censorship. This means they are using carrier-grade NAT (CGNAT) infrastructure to apply per-user or per-session blocking rules, track connections more precisely, and prevent circumvention techniques that rely on IP rotation or shared address spaces. NAT-based censorship allows them to correlate traffic to individual subscribers even when multiple users share the same public IP address. This significantly impacts the effectiveness of many traditional circumvention methods that assume only IP-based filtering. Why I am sending this to you: This document represents the Iranian government's planned technical roadmap for censorship. Understanding their methods — especially their DPI strategies, signature creation for Cloudflare WARP, NAT-based filtering, whitelisting approaches, and crisis-mode escalation — could help the Tor Project and the broader anti-censorship community develop more effective pluggable transports and circumvention tools. Specific insights that may be useful: - They are actively studying and blocking WireGuard, QUIC, and WARP - They use entropy-based detection on traffic patterns - They propose machine learning for anomaly detection - They distinguish between mobile and fixed-line operator deployments - They have a documented "gradual" deployment strategy that could be monitored - They are using NAT infrastructure to enable per-user and per-session tracking and blocking Potential risks to consider: - I am not a representative of the Iranian government — I am sharing this to help circumvention efforts. - The document is in Persian; I can assist with translation of specific technical sections if needed. You can find the original document in Void Verge's Telegram channel with the file name: secure.pdf What I am requesting from your team: 1. Acknowledgment of receipt 2. Analysis of the censorship techniques described, including the NAT-based approach 3. If possible, development or recommendation of specific pluggable transports or Tor Browser features that can resist the described DPI, NAT-based filtering, and blocking methods 4. Guidance on whether I should share this document with other anti-censorship groups (e.g., OONI, Censored Planet, Guardian Project) Additional details you may need: Original language: Persian (Farsi) Date on document: September 2025 (Shahrivar 1404) Document version: 2.2 Authoring team: Dr. Rasul Jalili's research team, Amnafzar-e-Amn-e-Sharif (Sharif University of Technology affiliated cybersecurity group) Intended recipients: Secretary of the Supreme Council of Cyberspace (policy copy) and Technical Deputy of the Communications Infrastructure Company How I can help further: - I can provide a full English translation of key sections - I can clarify any ambiguous technical terms or cultural references - I can share metadata about how this document was obtained (if safe to do so) Thank you for your critical work defending open access to information. I hope this intelligence helps you stay ahead of state-level censorship efforts. Sincerely, A concerned citizen of Iran

1 0

[FIRING:1] Bridges down -- bridges
by alertmanager＠prometheus2.torproject.org 14 Apr '26

14 Apr '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-04-13 21:26:21.034 +0000 UTC Summary: Too many bridgestrap failures Description: The percent of functional bridges is 0.0%. host: bridges.torproject.org:443 playbook: TODO title: Bridgestrap failures -----

2 1

[FIRING:1] builtin bridge unreachable -- blackbox_tcp
by alertmanager＠prometheus2.torproject.org 12 Apr '26

12 Apr '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-04-12 19:35:29.934 +0000 UTC Summary: The builtin bridge 45.145.95.6:27015 is unreachable Description: Unable to connect to the builtin bridge TCP port 45.145.95.6:27015 playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0

[FIRING:1] http service unreachable -- blackbox
by alertmanager＠prometheus2.torproject.org 06 Apr '26

06 Apr '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-03-27 12:28:14.934 +0000 UTC Summary: HTTP for https://bridges.torproject.org/status?id=5EDAC3B810E12B01F6FD8050D2FD3E277B… is unreachable Description: Unable to connect to HTTP port or response code is not the expected for https://bridges.torproject.org/status?id=5EDAC3B810E12B01F6FD8050D2FD3E277B… playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0

[FIRING:1] builtin bridge unreachable -- blackbox_tcp
by alertmanager＠prometheus2.torproject.org 05 Apr '26

05 Apr '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-03-27 02:48:44.934 +0000 UTC Summary: The builtin bridge 51.222.13.177:80 is unreachable Description: Unable to connect to the builtin bridge TCP port 51.222.13.177:80 playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0

[FIRING:1] Russia Vantage Point Offline for 100 hours -- metrics-standard
by alertmanager＠prometheus2.torproject.org 04 Apr '26

04 Apr '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-04-05 02:52:37.258 +0000 UTC Summary: Russia Vantage Point Offline Description: Russia Vantage Point probetelemetry-01.torproject.org:443 was Offline for at least 100 hours playbook: TODO -----

1 0

[FIRING:1] http service unreachable -- blackbox
by alertmanager＠prometheus2.torproject.org 01 Apr '26

01 Apr '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-03-27 12:28:14.934 +0000 UTC Summary: HTTP for https://bridges.torproject.org/status?id=5EDAC3B810E12B01F6FD8050D2FD3E277B… is unreachable Description: Unable to connect to HTTP port or response code is not the expected for https://bridges.torproject.org/status?id=5EDAC3B810E12B01F6FD8050D2FD3E277B… playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0

[FIRING:1] builtin bridge unreachable -- blackbox_tcp
by alertmanager＠prometheus2.torproject.org 31 Mar '26

31 Mar '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-03-27 02:48:44.934 +0000 UTC Summary: The builtin bridge 51.222.13.177:80 is unreachable Description: Unable to connect to the builtin bridge TCP port 51.222.13.177:80 playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0

[FIRING:1] http service unreachable -- blackbox
by alertmanager＠prometheus2.torproject.org 27 Mar '26

27 Mar '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-03-27 12:28:14.934 +0000 UTC Summary: HTTP for https://bridges.torproject.org/status?id=5EDAC3B810E12B01F6FD8050D2FD3E277B… is unreachable Description: Unable to connect to HTTP port or response code is not the expected for https://bridges.torproject.org/status?id=5EDAC3B810E12B01F6FD8050D2FD3E277B… playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0

[FIRING:1] builtin bridge unreachable -- blackbox_tcp
by alertmanager＠prometheus2.torproject.org 26 Mar '26

26 Mar '26

Total firing alerts: 1 ## Firing Alerts ----- Time: 2026-03-27 02:48:44.934 +0000 UTC Summary: The builtin bridge 51.222.13.177:80 is unreachable Description: Unable to connect to the builtin bridge TCP port 51.222.13.177:80 playbook: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui… -----

1 0