BGP hijacking remains a practical threat to circumvention infrastructure: BGPWatch reported 5,673 possible hijack events in 2024 alone, and approximately 43% of ASes currently do not enforce route origin validation, leaving RPKI-covered prefixes still vulnerable. An attacker can statistically divert 50% of traffic by announcing an equally specific prefix with the genuine origin and itself prepended as next hop.

HOWLR successfully detects 83% of the 1,902 real-world prefix hijack incidents observed in high-confidence Cloudflare Radar data from May 2026. The detection method fails when the hijacked prefix contains no authenticatable witnesses, and also cannot defend against routing adversaries capable of transparently forwarding non-targeted traffic within the prefix.

§4, §7 evaluation

HOWLR's T4 variant (scanning only port 443) reduces worst-case prefix scan time from 260 minutes to 4 minutes while missing fewer than 2 witnesses in 83.6% of prefixes; the worst-case drop was 13 witnesses in a high-density prefix, still leaving 15 usable witnesses. Over a 6-day monitoring period, 96% of the 30,217-witness set maintained 99+% uptime.

§5, §6 defense

HOWLR provides Light protection (≥3 witnesses in prefix) to 89% of Tor relay prefixes and Strong protection (≥8 witnesses from ≥2 CAs) to 64%, based on sampling 200 random relays. By contrast, DNS server prefixes receive Light protection in only 40% and Strong protection in only 12% of cases, reflecting their tendency toward residential or sparse hosting.

§6 evaluation

All sampled popular-service prefixes contain at least two TLS-authenticated witnesses, and more than half contain 35 or more witnesses; by contrast, only 40% of randomly selected prefixes feature any valid witnesses. CT log analysis across 5 months shows that witnesses span just 17.4% of the routable IPv4 space, confirming that witness coverage concentrates on professionally-hosted infrastructure.

§4 evaluation

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Iran executed a full-stack internet shutdown beginning at 18:45 UTC on January 8, 2026, withdrawing BGP prefix announcements nationwide and causing routing failures that prevented clients from completing TCP handshakes. Traffic dropped to effectively zero within hours of the shutdown's onset.

2026-free-the-internet-iran-internet-shutdown §Issue body / Abstract bgp-hijackip-blocking

During Iran's near-complete February 2026 shutdown, DNS-based tunneling (dnstt over UDP port 53) was identified by the community as the only functioning circumvention method, with participants successfully sharing public dnstt server configurations to maintain connectivity.

2026-gusgustavo-iran-internet-shutdown Issue body / community comments bgp-hijackip-blocking

Iran experienced a near-complete internet shutdown on February 28, 2026 beginning at approximately 07:00 UTC, with Cloudflare Radar measuring ~98% connectivity loss relative to the previous week, affecting Tehran, Fars, Isfahan, Alborz Province, and Razavi Khorasan simultaneously.

2026-gusgustavo-iran-internet-shutdown Issue body bgp-hijackip-blocking

Community experimentation during the February 2026 Iran shutdown revealed heterogeneity across ISPs in what survived: participants tested different DNS resolvers and ISPs to find working dnstt paths, indicating the BGP withdrawal was not perfectly uniform across all Iranian autonomous systems.

2026-gusgustavo-iran-internet-shutdown Issue comments bgp-hijackip-blocking

On Feb. 5, 2021, Campana Mythic (AS136168) announced Twitter's 104.244.42.0/24 prefix—apparently intending to blackhole Twitter traffic locally as part of the national Twitter block—but the route leaked to operators in Singapore and Vietnam, causing collateral disruption for Twitter users outside Myanmar. This accidental BGP leak corroborates evidence that Myanmar ISPs were independently implementing IP-level censorship without a centralized national kill switch.

2021-padmanabhan-multi-perspective §3.4 bgp-hijackip-blocking