Wikimedia's preferred deployment mode — ECH split-mode, which would use a third-party front-end's IP addresses to bypass IP-level blocking of Wikimedia's own address space — could not be trialed because no suitable front-end partner was found. Potential operators declined due to concerns about traffic volume, risk of inheriting Wikimedia's blocked reputation, or lack of a compatible business model.

Apple iOS devices showed zero ECH successes across all tested versions from iOS 9.1 through iOS 18.5 (totaling 383 accesses), and Mac OS systems showed sparse ECH support limited to Firefox on older macOS and Chrome on macOS 10.15.7. A single GREASEd access from iPadOS/18.0 (Mobile Safari) was the only signal of any Apple ECH awareness.

§6.3, Table 5; §6.5 evaluation

Even ECH-capable browsers frequently GREASE rather than attempt real ECH, with Firefox/138 succeeding only 50% of the time (164/325), Chrome/136 only 25% (42/167), and Chrome Mobile/136 only 24% (29/121). Firefox/139 performed better at 83% real ECH success (351/423), suggesting browser DNS handling of HTTPS RRs remains a significant barrier to ECH efficacy. GREASE sends a fake ECH extension that does not hide the inner SNI, so it provides no censorship resistance despite making the client appear ECH-aware.

§6.4, Table 8 evaluation

In a 41-day real-world ECH trial (2025-05-01 to 2025-06-11) across 14 server instances in 7 global data centers, 64% of accesses came from ECH-aware clients (success or GREASE) while 36% did not attempt ECH at all. Of 4,074 total log events, 1,660 were ECH successes, 825 were GREASE, and 1,589 were not-tried, indicating that today roughly 41% of traffic benefits from full ECH privacy protection. The trial found no measurable service disruption from enabling ECH.

§6.1, Table 3 evaluation

The DEfO project backported ECH support to nginx 1.22.1 (Debian bookworm's shipped version) and deployed it at 14 instances across 7 Wikimedia data centers with no service disruption over 41 days. The primary operational barrier was institutional review process for custom-built binaries and the novel HTTPS RR DNS record type, adding only a few days to the deployment timeline.

§3, §4, §7 deployment

Across all 7 global data centers (EU, USA, Singapore, Brazil), every data center recorded ECH successes with no observed evidence of regional ECH blocking or interference. ECH-aware client percentages varied by region — EU 75%, North America 63%, Asia 49%, South America 46% — but this was attributed to browser version distribution rather than censorship. The trial spanned 14 geographically distributed PoPs.

§6.2, §6.5, Table 4 evaluation

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

IPv6 does not inherently worsen fingerprinting privacy: dual-stack complete sites are measurably harder to fingerprint via IPv6 (45%) than IPv4 (56%), contrary to community fears. The key driver is not the protocol but hosting provider behavior—Cloudflare, Google, and Fastly co-locate large clusters of domains behind a small set of shared IPv6 addresses, creating structured similarity clusters that reduce classifier separability, while Amazon allocates domains across vast unique IPv6 prefixes, increasing fingerprintability.

2026-ahmad-more-space-less §7.1, §6.1, §6.2 website-fingerprintip-blocking

LetsVPN (快连) announced termination of China mainland operations on April 28, 2026, stating the team had attempted adjustments 'almost every hour' for 20 days before concluding the connectivity problem was unsolvable. A follow-up announcement on May 8 declared 'resumption of global standard operations' but explicitly stated it could not guarantee China mainland availability.

2026-anon-2026-27-vpn §3 (快连 / LetsVPN section) ip-blockingdpi

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

2026-anon-2026-27-vpn §5 (Human Rights Watch section) port-blockingdpiip-blocking

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

Chinese users treat full proxy/VPN (Shadowsocks, V2Ray/Clash, commercial VPNs) as the '终极大杀器' (ultimate solution) for bypassing GitHub DNS poisoning, implying that lighter-weight DNS-only fixes fail in some network environments where the censor adds firewall-layer blocking beyond DNS.

2026-anon-6-github-dns §3 使用代理或 VPN dns-poisoningip-blocking