The author released a netDb scanner tool that reads the local I2Pd network database, identifies routers hosted on Chinese IP ranges, and exports results as IP lists for firewall rules. The tool supports filtering by country (--cn-only), JSON export, and IP-list export, enabling operators to block suspected surveillance nodes at the OS firewall layer before any I2P connection is made.

The suspected Chinese surveillance nodes are hosted in data centers that explicitly prohibit 'circumvention services' (proxy/VPN services) in their terms of service, yet the nodes operate safely for extended periods. This suggests the operators benefit from either state-sanctioned access or ISP-level protection from ToS enforcement, consistent with a government or contractor intelligence-collection operation.

Issue body deployment

A community scan of the I2P network database (netDb) in July 2026 identified a cluster of suspicious router nodes uniformly running I2P version 0.9.66 (three versions behind the current 0.9.69), all hosted in Chinese domestic data centers rather than residential broadband. The nodes exhibit anomalous uniformity in their router capabilities (Caps) configuration and self-reported versions, a pattern inconsistent with organic user deployments.

Issue body detection

The suspicious Chinese I2P nodes rotate their IP addresses regularly and simultaneously as a coordinated group, and some of the observed IPs have prior history of malicious behavior (SSH brute-forcing, remote exploitation) in threat-intelligence databases. Simultaneous coordinated IP rotation distinguishes state-run infrastructure from organic users and is a fingerprint of centrally managed probe fleets.

Issue body detection

The paper demonstrates that two protocol-specific censorship changes — QUIC blocking reaching 100% and DNS-over-TCP blocking reaching 96.68% — both occurred in the scan conducted immediately before Iran's June 18 full blackout, and that similar shutdown preparations were also documented before Iran's January 2026 shutdown. The authors hypothesize that continuous long-term measurement of protocol-specific censorship rates could provide advance warning of impending shutdowns before they come into full effect.

2026-anon-insights-into-iranian §3, §4 http3-quic-blockdns-poisoningmeasurement-platform

Iran's source-IP allowlist severely restricted outbound access before the May 26, 2026 partial restoration: only ~0.017% (~2,000 of 11,766,454 spoofed Iranian IPs) could reach destinations outside Iran. After restoration, reachable IPs increased nearly fourfold to ~0.07% (~8,000), with most newly reachable addresses originating from Noyan Abr Arvan Co. (ASN 202468), indicating expansion rather than removal of the allowlist.

2026-lunarcanvas-swift-look-into §4.1.1 ip-blockingmeasurement-platform

Inbound access to Iran remains heavily restricted even after the May 26 restoration: only ~2.8% of tested global /24 blocks (~400,000 of 14,461,944 representative IPs) could reach the Iran vantage point, compared to over 70% for comparable hosts outside Iran — more than 25× lower reachability — demonstrating that Iran enforces allowlist-based destination-IP filtering on inbound traffic as well as outbound.

2026-lunarcanvas-swift-look-into §4.1.3 ip-blockingmeasurement-platform

'Resource Inaccessible' was the most frequently reported issue (61% of 119 submitted reports) during a month of naturalistic Tor Browser browsing, followed by CAPTCHAs (18%), Broken Content (17%), Other Issues (13%), and Timeouts (5%). These categories document the operational failure modes that degrade everyday Tor Browser usability beyond protocol-level censorship.

2026-micallef-reportor-facilitating-user §6.1, Figure 3 ip-blockingmeasurement-platform

The privacy properties of Tor Browser structurally preclude automated telemetry collection, creating a persistent blind spot for diagnosing user experience failures at scale. ReporTor demonstrates that anonymous voluntary in-situ reporting — transmitted over the Tor network and stored in a password-protected onion-service database — can substitute for telemetry: 119 reports over one month from five expert users sufficed to reproduce approximately half of reported issues exactly and identify root causes for most of the remainder.

2026-micallef-reportor-facilitating-user §1, §7.1 measurement-platform

A compiled blocklist dataset documents 43,083 apex domains blocked via DNS filtering across 6 Indian ISPs, representing one of the largest systematic inventories of Indian DNS censorship scope published to date.

2026-qurbat-list-domains-blocked compiled_blocklist.csv (main dataset) dns-poisoningmeasurement-platform