The DEfO project backported ECH support to nginx 1.22.1 (Debian bookworm's shipped version) and deployed it at 14 instances across 7 Wikimedia data centers with no service disruption over 41 days. The primary operational barrier was institutional review process for custom-built binaries and the novel HTTPS RR DNS record type, adding only a few days to the deployment timeline.

Apple iOS devices showed zero ECH successes across all tested versions from iOS 9.1 through iOS 18.5 (totaling 383 accesses), and Mac OS systems showed sparse ECH support limited to Firefox on older macOS and Chrome on macOS 10.15.7. A single GREASEd access from iPadOS/18.0 (Mobile Safari) was the only signal of any Apple ECH awareness.

§6.3, Table 5; §6.5 evaluation

Even ECH-capable browsers frequently GREASE rather than attempt real ECH, with Firefox/138 succeeding only 50% of the time (164/325), Chrome/136 only 25% (42/167), and Chrome Mobile/136 only 24% (29/121). Firefox/139 performed better at 83% real ECH success (351/423), suggesting browser DNS handling of HTTPS RRs remains a significant barrier to ECH efficacy. GREASE sends a fake ECH extension that does not hide the inner SNI, so it provides no censorship resistance despite making the client appear ECH-aware.

§6.4, Table 8 evaluation

In a 41-day real-world ECH trial (2025-05-01 to 2025-06-11) across 14 server instances in 7 global data centers, 64% of accesses came from ECH-aware clients (success or GREASE) while 36% did not attempt ECH at all. Of 4,074 total log events, 1,660 were ECH successes, 825 were GREASE, and 1,589 were not-tried, indicating that today roughly 41% of traffic benefits from full ECH privacy protection. The trial found no measurable service disruption from enabling ECH.

§6.1, Table 3 evaluation

Wikimedia's preferred deployment mode — ECH split-mode, which would use a third-party front-end's IP addresses to bypass IP-level blocking of Wikimedia's own address space — could not be trialed because no suitable front-end partner was found. Potential operators declined due to concerns about traffic volume, risk of inheriting Wikimedia's blocked reputation, or lack of a compatible business model.

§2 deployment

Across all 7 global data centers (EU, USA, Singapore, Brazil), every data center recorded ECH successes with no observed evidence of regional ECH blocking or interference. ECH-aware client percentages varied by region — EU 75%, North America 63%, Asia 49%, South America 46% — but this was attributed to browser version distribution rather than censorship. The trial spanned 14 geographically distributed PoPs.

§6.2, §6.5, Table 4 evaluation

Encrypted DNS (DoH, DoT) and Encrypted ClientHello (ECH) fully hide plaintext domain names from on-path observers but leave destination IP addresses visible, enabling IP-based fingerprinting with no protocol-level metadata required. An adversary collecting only NetFlow/IPFIX destination-IP records—without TLS fingerprints, packet timing, or port metadata—correctly identifies 72% of all 520K dual-stack websites over IPv4 and 68% over IPv6.

2026-ahmad-more-space-less §1, §3, §6.1 website-fingerprintsni-blockingesni-eh-blocking

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.

2026-article19-tightening-the-net §4, §5 dpisni-blockingthrottling

Russia's TSPU devices switched from broad QUIC blocking to SNI-dependent QUIC censorship between May 2022 and July 2023—at least nine months before the GFW introduced SNI-based QUIC censorship, which was previously considered the first of its kind. This transition was discussed only on Russian-language forums (ntc.party) and went unnoticed by the international research community for approximately three years.

2026-heitmann-russia-s-early-introduction §2.3, §4 sni-blockinghttp3-quic-block

Testing the Tranco Top 100k domain list from Russian vantage points shows that all 2,644 domains blocked over TLS SNI are also blocked over QUIC SNI, and domains accessible via TLS are accessible via QUIC—indicating the TSPU maintains a unified SNI blocklist across protocols. Additionally, 31 domain patterns including discord.com exhibit 'residual clearance': QUIC connections to those domains are not censored when immediately preceded by non-censored data on the same 4-tuple; 22 domains are only blocked on port 443.

2026-heitmann-russia-s-early-introduction §3, Table 3 sni-blockinghttp3-quic-blockdpi