HOWLR successfully detects 83% of the 1,902 real-world prefix hijack incidents observed in high-confidence Cloudflare Radar data from May 2026. The detection method fails when the hijacked prefix contains no authenticatable witnesses, and also cannot defend against routing adversaries capable of transparently forwarding non-targeted traffic within the prefix.

HOWLR's T4 variant (scanning only port 443) reduces worst-case prefix scan time from 260 minutes to 4 minutes while missing fewer than 2 witnesses in 83.6% of prefixes; the worst-case drop was 13 witnesses in a high-density prefix, still leaving 15 usable witnesses. Over a 6-day monitoring period, 96% of the 30,217-witness set maintained 99+% uptime.

§5, §6 defense

HOWLR provides Light protection (≥3 witnesses in prefix) to 89% of Tor relay prefixes and Strong protection (≥8 witnesses from ≥2 CAs) to 64%, based on sampling 200 random relays. By contrast, DNS server prefixes receive Light protection in only 40% and Strong protection in only 12% of cases, reflecting their tendency toward residential or sparse hosting.

§6 evaluation

BGP hijacking remains a practical threat to circumvention infrastructure: BGPWatch reported 5,673 possible hijack events in 2024 alone, and approximately 43% of ASes currently do not enforce route origin validation, leaving RPKI-covered prefixes still vulnerable. An attacker can statistically divert 50% of traffic by announcing an equally specific prefix with the genuine origin and itself prepended as next hop.

§2.2 detection

All sampled popular-service prefixes contain at least two TLS-authenticated witnesses, and more than half contain 35 or more witnesses; by contrast, only 40% of randomly selected prefixes feature any valid witnesses. CT log analysis across 5 months shows that witnesses span just 17.4% of the routable IPv4 space, confirming that witness coverage concentrates on professionally-hosted infrastructure.

§4 evaluation

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

During the January 8–9, 2026 shutdown, Iran's .ir DNS zone became unavailable in-country, with resolution routed exclusively to a single nameserver located in Amsterdam. This infrastructure takeover was simultaneous with the routing blackout, eliminating DNS as an independent resolution path.

2026-free-the-internet-iran-internet-shutdown §Abstract dns-poisoningbgp-hijack

Iran executed a full-stack internet shutdown beginning at 18:45 UTC on January 8, 2026, withdrawing BGP prefix announcements nationwide and causing routing failures that prevented clients from completing TCP handshakes. Traffic dropped to effectively zero within hours of the shutdown's onset.

2026-free-the-internet-iran-internet-shutdown §Issue body / Abstract bgp-hijackip-blocking

The January 2026 Iranian shutdown encompassed not only global internet connectivity but also domestic inter-network connectivity and PSTN telephony — even domestic phone calls were reported impossible during the blackout period. This represents a broader telecommunications blockade beyond IP-layer isolation.

2026-free-the-internet-iran-internet-shutdown §Issue body bgp-hijackport-blocking

Iran's January 8, 2026 shutdown was confirmed by Cloudflare Radar traffic telemetry showing a near-instantaneous collapse in Iranian internet traffic to effectively zero. The shutdown was implemented rapidly enough that the Cloudflare Radar timestamp (18:45 UTC) serves as a precise onset marker.

2026-free-the-internet-iran-internet-shutdown §Issue body / Cloudflare Radar source bgp-hijack

During Iran's near-complete February 2026 shutdown, DNS-based tunneling (dnstt over UDP port 53) was identified by the community as the only functioning circumvention method, with participants successfully sharing public dnstt server configurations to maintain connectivity.

2026-gusgustavo-iran-internet-shutdown Issue body / community comments bgp-hijackip-blocking