Chinese users accessing google.com on Android devices through circumvention proxies experience forced HTTP redirects to google.cn/m rather than the expected google.com destination. The behavior is observed specifically on proxied connections, suggesting either in-path HTTP redirect injection by the GFW or Google's own geo-targeting logic acting on IP or device signals that persist through the proxy.

The redirect from google.com to google.cn/m on proxied Android connections in China is ambiguous as to origin: it may represent GFW-side in-path HTTP redirect packet injection, or Google's server-side geo-redirect responding to signals (device locale, exit IP, or Accept-Language headers) that survive the proxy hop. The thread documents this as an unresolved mechanistic question requiring disambiguation.

Issue body / abstract detection

Android users in China accessing google.com through circumvention tools report forced redirection to google.cn/m instead of the expected GFW block page. The thread investigates three possible mechanisms: GFW HTTP packet injection, Google's server-side geolocation redirect, or ISP-level interference—each implying a different interception layer.

Issue body / thread opening detection

Appending the /ncr (no-country-redirect) parameter to google.com requests successfully bypasses the forced redirect to google.cn/m for Chinese users on circumvention proxies. This workaround operates at the application layer and requires no changes to the underlying transport or proxy configuration.

Issue comments / abstract defense

The redirect behavior varies depending on which proxy type is used, indicating the interception is sensitive to how the proxy mediates the connection rather than being a blanket IP- or DNS-level block. This suggests the triggering condition is protocol- or flow-specific rather than purely destination-based.

Issue thread discussion evaluation

An internet-wide scan of 500k IP addresses from an in-country VPS vantage point found TCP establishment-interception injections on 43,479 addresses (8.7% of scanned), with over 70% concentrated in two Akamai ASes (AS16625 and AS20940). The injection pattern — triggered by the first packet sent to these addresses — is consistent with targeted blocking of domain-fronting proxies hosted on Akamai CDN.

2025-alaraj-iran-refraction §4.1.2 packet-injectionrst-injectionip-blocking

Iran's censorship of refraction-networking proxies (Conjure via Psiphon) is not monolithic: different ISPs independently deploy different techniques and timelines. Over 800 million logged Conjure connections from July 2023–February 2025 across 10+ Iranian ASes show TCI (AS58224, ~33% of traffic) uses packet injection, while MCCI/Hamrah-e Avval (AS197207, ~22%) applies IP-based blocking, and some ASes (Parsonline AS16322, Shatel AS31549) show no proxy blocking at all.

2025-alaraj-iran-refraction §4 rst-injectionip-blockingpacket-injectiondpi

Starting October 1, 2023, the GFW began injecting HTTP 301 and 302 responses to connections destined for 1.1.1.1:80, redirecting clients to China's National Anti-Fraud Center (182.43.124.6, AS58519 China Telecom Cloud). Over 6,169 HTTP requests from a Tencent Cloud Beijing vantage point (AS45090), the GFW injected 301 responses at a 9.06% rate and 302 responses at a 28.5% rate.

2023-gfw-blocking-1111 Major observations / Analysis on the injection to 1.1.1.1:80 packet-injectionip-blocking

From September 5–20, 2023, the GFW blocked 1.1.1.1:443 via TCP RST injection; starting October 1, 2023, the mechanism shifted to HTTP packet injection on port 80, while port 443 behavior became inconsistent across ASes — from one AS45090 vantage point, HTTPS connections to 1.1.1.1 still succeeded while other observers confirmed RST injection.

2023-gfw-blocking-1111 Major observations rst-injectionip-blockingpacket-injection

136 Russian government domains (25.09% of 542 accessible ones) blocked access to all tested countries outside Russia, and a further 112 (20.66%) were accessible only from Russian and Kazakhstani vantage points. Geoblocking was implemented via heterogeneous, uncoordinated mechanisms—DNS timeouts, TCP timeouts, HTTP 403 Forbidden responses, and explicit blockpages—across different domains, indicating an ad hoc emergency response with no central policy.

2023-ramesh-network §4.2 ip-blockingdns-poisoningpacket-injection

Data center VPSes predominantly experienced TCP connection timeouts and resets—with the highest-blocking VPS censoring 96.8% of tested domains—while residential ISPs were substantially more likely to inject explicit blockpages citing Roskomnadzor's registry, confirming that blocking mechanism varies significantly by network tier even when blocking rates are similar.

2020-ramesh-decentralized §VI-B rst-injectionip-blockingpacket-injectionkeyword-filtering