Russia's TSPU (Технические средства противодействия угрозам) is the national censorship infrastructure operated by Roskomnadzor, deployed inline at Russian ISPs. Technical documentation of its architecture and operating principles has been made publicly available via YouTube presentations by Russian-language researchers. The system is evidently not classified, so circumvention researchers can study its detection logic from these materials rather than relying solely on empirical measurement; a 2021 presentation documents TSPU performing in-path filtering and traffic redirection rather than relying on endpoint-level DNS alone.

The source notes that CDN-based techniques are discussed as viable methods for bypassing TSPU filtering controls, consistent with domain-fronting and meek-style approaches that route traffic through high-value CDN infrastructure that censors are reluctant to block wholesale.

Abstract defense

TSPU represents a censor infrastructure model that has been documented for export analysis — similar DPI-based national filtering systems have been identified in Myanmar and Pakistan, suggesting shared architectural lineage with Russian censorship technology under Belt-and-Road frameworks. This mirrors documented GFW-derived exports from China.

Abstract deployment

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Geedge co-founder Fang Binxing—named 'father of the Great Firewall' in company documents—explicitly linked Geedge's international expansion to China's Belt and Road Initiative in a 2024 speech, and a Geedge job advertisement sought candidates willing to travel to Pakistan, Malaysia, Bahrain, Algeria, and India. This confirms BRI as an institutional channel for GFW-derived censorship infrastructure export, not merely bilateral commercial deals.

2025-wkrp-leak-geedge-networks body dpiip-blockingthrottling

A September 2025 leak of 100,000+ internal documents from Geedge Networks—co-founded by Great Firewall architect Fang Binxing—confirms export of GFW-derived Tiangou Secure Gateway (TSG) to Myanmar, Pakistan, Ethiopia, and Kazakhstan, providing those governments with DPI-based filtering, throttling, VPN blocking, and internet-blackout capabilities previously unavailable to them. Pakistan's deployment replaced Sandvine's Web Monitoring System infrastructure after Sandvine was sanctioned and exited in 2023, with Geedge apparently utilizing existing Sandvine hardware. Kazakhstan was the first client, from 2018, and Geedge claims more than 40 global service providers as clients under the Belt and Road Initiative framework.

2025-wkrp-leak-geedge-networks body dpiip-blockingthrottlingtraffic-shape

During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.

2025-iran-shutdown-measurement §Tool Performance dpithrottling

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking