The source notes that CDN-based techniques are discussed as viable methods for bypassing TSPU filtering controls, consistent with domain-fronting and meek-style approaches that route traffic through high-value CDN infrastructure that censors are reluctant to block wholesale.

Russia's TSPU (Технические средства противодействия угрозам) is the national censorship infrastructure operated by Roskomnadzor, deployed inline at Russian ISPs. Technical documentation of its architecture and operating principles has been made publicly available via YouTube presentations by Russian-language researchers. The system is evidently not classified, so circumvention researchers can study its detection logic from these materials rather than relying solely on empirical measurement; a 2021 presentation documents TSPU performing in-path filtering and traffic redirection rather than relying on endpoint-level DNS alone.

Abstract deployment

TSPU represents a censor infrastructure model that has been documented for export analysis — similar DPI-based national filtering systems have been identified in Myanmar and Pakistan, suggesting shared architectural lineage with Russian censorship technology under Belt-and-Road frameworks. This mirrors documented GFW-derived exports from China.

Abstract deployment

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.

2026-article19-tightening-the-net §4, §5 dpisni-blockingthrottling

Testing the Tranco Top 100k domain list from Russian vantage points shows that all 2,644 domains blocked over TLS SNI are also blocked over QUIC SNI, and domains accessible via TLS are accessible via QUIC—indicating the TSPU maintains a unified SNI blocklist across protocols. Additionally, 31 domain patterns including discord.com exhibit 'residual clearance': QUIC connections to those domains are not censored when immediately preceded by non-censored data on the same 4-tuple; 22 domains are only blocked on port 443.

2026-heitmann-russia-s-early-introduction §3, Table 3 sni-blockinghttp3-quic-blockdpi

Reproducing Zohaib et al.'s 10-payload QUIC parser test suite against Russian TSPU devices reveals that the Russian QUIC parser differs meaningfully from the GFW: payload 8 (PING and PADDING frames inserted before the Crypto frame), which circumvents the GFW, does not bypass Russian censorship. Payload 10 (QUICv2) bypasses both censors. Payload 9 (ECH with outer SNI cloudflare-ech.com) is blocked by Russia; payload 3 (version bytes 0x00000002 with invalid MAC) is blocked by both.

2026-heitmann-russia-s-early-introduction Appendix B, Table 2 http3-quic-blockdpisni-blocking

As measured from three Russian vantage points in March–April 2026, TSPU devices decrypt QUIC Initial packets, locate the SNI extension in the embedded TLS handshake, and drop packets with forbidden domains plus all subsequent packets on the 4-tuple for 420 seconds (timer resets on each packet). Censorship is unidirectional (outgoing only), covers all destination ports up to 65535 at Saint Petersburg and Novosibirsk (Moscow exempts 22% of system ports 1–1023), and targets only QUICv1—QUICv2 passes uncensored at all vantage points.

2026-heitmann-russia-s-early-introduction §3 sni-blockinghttp3-quic-blockdpi