Encrypted DNS (DoH, DoT) and Encrypted ClientHello (ECH) fully hide plaintext domain names from on-path observers but leave destination IP addresses visible, enabling IP-based fingerprinting with no protocol-level metadata required. An adversary collecting only NetFlow/IPFIX destination-IP records—without TLS fingerprints, packet timing, or port metadata—correctly identifies 72% of all 520K dual-stack websites over IPv4 and 68% over IPv6.

IP-based fingerprints are operationally stable: approximately 60% of domains exhibit no IP changes across the three-month measurement period for both IPv4 and IPv6. Among churning domains, per-domain churn behavior is comparable across protocols—about 28% of churning IPv4 domains rotate within one hour on average vs 35% for IPv6. Fingerprint databases of ≈100 KB per site (50–60 GB for 520K sites) can be maintained with only periodic DNS re-resolution at negligible overhead for adversaries already collecting NetFlow data.

§6.4, §5.3.2 evaluation

IP-based website fingerprinting achieves 93–94% top-1 accuracy on dual-stack incomplete websites (those with any IPv4-only third-party dependencies) using both IPv4 and IPv6 fingerprints across 228K sites. For dual-stack complete sites (all resources reachable over IPv6), accuracy drops to 56% over IPv4 and 45% over IPv6. The discriminating signal comes almost entirely from secondary resource IPs: using only the primary domain's IP yields 5–8% accuracy regardless of protocol.

§6.1, Table 1 detection

IPv6 does not inherently worsen fingerprinting privacy: dual-stack complete sites are measurably harder to fingerprint via IPv6 (45%) than IPv4 (56%), contrary to community fears. The key driver is not the protocol but hosting provider behavior—Cloudflare, Google, and Fastly co-locate large clusters of domains behind a small set of shared IPv6 addresses, creating structured similarity clusters that reduce classifier separability, while Amazon allocates domains across vast unique IPv6 prefixes, increasing fingerprintability.

§7.1, §6.1, §6.2 detection

Raw IPv6 address entropy is inflated by continuous discovery of previously-unseen addresses throughout the measurement period (1.04M distinct IPv6 vs 552K IPv4 addresses observed), giving a misleading impression of higher fingerprint discriminability. Realized entropy—computed per crawl-batch snapshot to exclude ephemeral addresses never seen during testing—shows more than 20% of IPv6 addresses provide less information gain than their IPv4 counterparts, explaining why dual-stack complete IPv6 fingerprinting accuracy (45%) underperforms IPv4 (56%) despite higher raw uniqueness.

§6.3, Figure 6, Figure 7 evaluation

Of 640,694 TLS 1.3 servers in the Tranco Top 1M (Feb 2025), 51.28% parse ECH extensions but only 43% actually handshake ECH — and virtually all of those are Cloudflare servers (278,040). Only 6 non-Cloudflare servers successfully handshaked ECH. Cloudflare's own servers have a 44% non-advertisement rate: servers that can handshake ECH but do not publish their ECH configuration in DNS, typically because the operator manages their own DNS outside Cloudflare. The total number of advertised ECH configurations dropped from ~180,000 in November 2024 to ~150,000 by April 2025.

2025-niere-encrypted §4.1, §4.2, Figure 3, Figure 4 sni-blockingesni-eh-blocking

Chrome and Firefox send GREASE ECH extensions in every ClientHello message, meaning a censor that blocks all ECH-containing ClientHellos would block all Chrome and Firefox TLS traffic. Cloudflare's static outer SNI "cloudflare-ech.com" in all its ECH configurations makes real ECH connections trivially distinguishable from GREASE ECH — censors can block real ECH connections to Cloudflare without triggering GREASE collateral damage. Cloudflare rejects ECH handshakes with omitted or invalidated outer SNI values; non-Cloudflare ECH deployments accept missing and invalid outer SNIs.

2025-niere-encrypted §2.1, §4.1, §6 sni-blockingesni-eh-blocking

Only 1.5–2.25% of domains from TLD zone files have a valid ESNI key, with 15.4K of the top 100K and 143.3K of the top 1M popular domains supporting ESNI. All ESNI-supported domains are hosted by Cloudflare, making ESNI-enabled connections trivially distinguishable from the vast majority of TLS traffic and a low-collateral-damage blocking target for censors.

2022-hoang-measuring §4.2 esni-eh-blockingsni-blocking

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.

2026-article19-tightening-the-net §4, §5 dpisni-blockingthrottling