VPN detection & firewall research
Long-form, citation-backed posts on VPN detection, national censorship systems, and the TLS / TCP fingerprint research that powers modern IP classification. Written for engineers and security researchers.
How the Great Firewall of China Works in 2026 — A Technical Explainer
Research-backed GFW explainer: asymmetric filtering, QUIC censorship, Wallbleed DNS leak, Geedge Networks docs, and what it means for VPN users.
By Mehmood Ali·2026-04-22·14 min readgreat firewallchinacensorshipHow VPN Detection Actually Works — The Research-Backed 7-Layer Method
The 7 layers a modern VPN detector combines: IP intel, TCP/TLS fingerprints, SNITCH RTT (NDSS 2025), active probing, client signals. With citations.
By Fizzah Mehtab·2026-04-22·6 min readVPN detectionJA3SNITCHRussia's TSPU System: How Roskomnadzor Blocks VPNs at the ISP Level
Russia's TSPU: in-path, stateful DPI on 1M+ endpoints across 650 ASes. How it detects and throttles VPN traffic, and what separates it from China's GFW.
By Mehmood Ali·2026-04-22·12 min readrussiaTSPUroskomnadzorIran's Internet Censorship: NIN, SIAM, and Mobile-Side Surveillance
Iran's layered censorship: National Information Network, SIAM mobile surveillance (2022 leak), CCDOC blocklist, and the technical stack behind each.
By Fizzah Mehtab·2026-04-22·11 min readiranSIAMNINJA3 and JA4 Fingerprinting Explained: How TLS Reveals Your VPN Client
JA3 and JA4 hash the TLS ClientHello to reliably identify the client library. Why Chrome looks different from Firefox, and OpenVPN from both. Full breakdown.
By Mehmood Ali·2026-04-22·13 min readJA3JA4TLS fingerprintingChina's 'Great Unplug' (April 2026): Inside the Physical VPN Server Takedown
April 1, 2026: thousands of VPN proxy nodes physically unplugged after leaked notices ordered datacenters to cut all circumvention servers. What we know.
By Fizzah Mehtab·2026-04-22·11 min readChinagreat firewallVPN crackdownFBI vs SocksEscort: The 369,000-IP Residential Proxy Botnet Takedown (March 2026)
FBI + Europol dismantled SocksEscort: 369,000 compromised routers across 163 countries. What AVrecon did, how the botnet ran, and why detection matters.
By Mehmood Ali·2026-04-22·12 min readFBIresidential proxybotnetIran's 52-Day Internet Blackout (2026): Technical Anatomy of the Longest National Shutdown
Iran offline for 1,224 consecutive hours — longest national disruption on record. What the blackout looks like technically and which tools still work.
By Fizzah Mehtab·2026-04-22·10 min readIraninternet shutdownblackoutRussia's 150-Ruble Mobile VPN Tax: How Roskomnadzor Is Pricing VPNs Out (2026)
Russia blocked 469 VPN services and added a 150-RUB/GB surcharge on international mobile traffic above 15 GB/month. How the policy and TSPU enforce it.
By Mehmood Ali·2026-04-22·9 min readRussiaTSPUVPN taxREALITY, Xray, and AmneziaWG: The 2026 Anti-Censorship Protocol Stack Explained
REALITY, Xray and AmneziaWG: the three protocols carrying anti-censorship in 2026. How each defeats DPI and which combination survives today's Great Firewall.
By Fizzah Mehtab·2026-04-22·14 min readREALITYXrayAmneziaWGHow to Detect VPN Users in 2026: A Developer's Guide (JavaScript + Server)
Code-first guide to detecting VPN, proxy, Tor and datacenter IPs. JS signals (WebRTC, timezone, language) + server signals (ASN, JA3, RTT) and how to combine.
By Mehmood Ali·2026-04-22·15 min readdeveloper guideJavaScriptVPN detectionWe Just Released 9 Free IP Intelligence Datasets (CSV, JSON, Auto-Refreshed)
Tor exits, commercial VPN ASNs, Mullvad relays, Cloudflare and AWS IP ranges, residential-proxy backbones — downloadable free, CC-BY 4.0, refreshed hourly to daily. Here's what's in each and how to use them.
By Fizzah Mehtab·2026-04-23·6 min readdatasetsTorVPN detectionVPN Detection API Comparison (2026): IPQualityScore, IPHub, GetIPIntel, Spur, IPinfo, IPLogs
Side-by-side comparison of the six most-used IP intelligence and VPN detection APIs in 2026 — pricing, signals, accuracy, free tier. Honest, no affiliates.
By Mehmood Ali·2026-04-22·13 min readcomparisonIPQualityScoreSpur