Blocking of AO3 in China since 2020 produced a fraudulent mirror-site ecosystem that deceived users: one social media post documented financial extortion through a mirror site, mirror sites charged for fanworks (exposing original authors to legal risk), and critically, mirrors collected domestic phone numbers—which are legally linked to government identity—unlike the real AO3 which requires only an email address. Users could not reliably distinguish mirror sites from the canonical platform.

Fans in Chinese transformative fandom developed systematic coded language to reference banned platforms and circumvent link blocking: AO3 was referred to as 'the red and white website whose name cannot be mentioned,' direct URLs were converted to text passwords posted in comments, and fan communities used numeric codes (e.g., '123456') to identify celebrity pairings in ways opaque to platform keyword filters. These community-maintained encoding conventions were required knowledge for platform access.

§5.1.3, §5.2.1 defense

Contrary to an apathetic response to surveillance, fans actively constructed collective 'red lines' — community-shared threat models distinguishing definitely dangerous activities from acceptable gray-area behaviors. This community-level threat modeling was shaped by real incidents (e.g., the 2024–2025 Haitang author arrests) and operated in tension with privacy solutions: individual circumvention (e.g., accessing AO3 via VPN) did not restore community function because the broader fandom remained trapped on domestic platforms.

§Abstract, §5.2 evaluation

Chinese platforms employ keyword-based algorithmic censorship that produces unexpected false positives even on self-censored content: one participant reported that a 4,000-word work posted as a whole was blocked, but splitting it into two 2,000-word segments caused both halves to be blocked, while splitting the same content into three parts allowed all three to post. The participant interpreted this as the algorithm learning to recognize their work over time, and ceased testing for fear of 'feeding the AI.'

§5.1.1 detection

Among 10 interviewed overseas members of Chinese transformative fandom, 7 used a VPN to access banned sites while in China, yet VPN distrust was a documented adoption barrier: one participant stated, 'I am considering whether the VPN might be under government surveillance. Some VPNs seem like they are fully monitored by the government, while others, which are more private, feel safer to use.' Separately, many fans inside China lacked awareness of VPNs entirely, assuming blocked platforms were permanently inaccessible.

§5.1.3 evaluation

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

IPv6 does not inherently worsen fingerprinting privacy: dual-stack complete sites are measurably harder to fingerprint via IPv6 (45%) than IPv4 (56%), contrary to community fears. The key driver is not the protocol but hosting provider behavior—Cloudflare, Google, and Fastly co-locate large clusters of domains behind a small set of shared IPv6 addresses, creating structured similarity clusters that reduce classifier separability, while Amazon allocates domains across vast unique IPv6 prefixes, increasing fingerprintability.

2026-ahmad-more-space-less §7.1, §6.1, §6.2 website-fingerprintip-blocking

LetsVPN (快连) announced termination of China mainland operations on April 28, 2026, stating the team had attempted adjustments 'almost every hour' for 20 days before concluding the connectivity problem was unsolvable. A follow-up announcement on May 8 declared 'resumption of global standard operations' but explicitly stated it could not guarantee China mainland availability.

2026-anon-2026-27-vpn §3 (快连 / LetsVPN section) ip-blockingdpi

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

2026-anon-2026-27-vpn §5 (Human Rights Watch section) port-blockingdpiip-blocking

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

Chinese users treat full proxy/VPN (Shadowsocks, V2Ray/Clash, commercial VPNs) as the '终极大杀器' (ultimate solution) for bypassing GitHub DNS poisoning, implying that lighter-weight DNS-only fixes fail in some network environments where the censor adds firewall-layer blocking beyond DNS.

2026-anon-6-github-dns §3 使用代理或 VPN dns-poisoningip-blocking