Out in the Open: On the Implementation of Mobile App Filtering in India

For Tier 2 apps (IP geo-blocking only), using a VPN with a foreign endpoint was sufficient to restore access. For Tier 1 apps (SIM + IP geo-blocking), the authors confirmed that (1) removing the Indian SIM card and accessing via WiFi, or (2) intercepting HTTP traffic with a MITM proxy to suppress or rewrite the carrier_region=IN parameter, fully bypassed server-side censorship. The authors note that Indian users primarily rely on mobile Internet, making SIM removal impractical as a user-facing solution.

§4.3, §5 defense ip-blockingkeyword-filtering in

Across four major Indian ISPs (Reliance Jio, Airtel, Vodafone-Idea, and ACT) cumulatively serving more than 95% of Indian clients, the authors found zero network-level interference with 220 banned Chinese apps. DNS resolved to legitimate addresses, TCP and TLS handshakes completed successfully with actual app servers, and responses were served directly by app publishers — not by ISP middleboxes.

§4.2 evaluation ip-blocking in

After India imposed a permanent ban in January 2021, seven of the eight previously SIM-only-blocked apps escalated to dual-factor filtering: they continued extracting carrier_region=IN from the SIM card while simultaneously adding IP geo-blocking. Accessing these apps now requires both a VPN (for source IP masking) and SIM removal or carrier_region parameter suppression; MICO Chat remained the sole app using only SIM-based blocking.

§4.3 (Permanent ban subsection), Table 2 evaluation ip-blockingkeyword-filtering in

Seven of the 220 banned apps (Tier 1, including TikTok, Likee, Kwai, UC Browser, FaceU, Hago, and V-Fly) used the Android TelephonyManager.getSimCountryISO() API to read the primary SIM's country code and embed a carrier_region=IN parameter in HTTP requests, enabling server-side identification and blocking of Indian users regardless of source IP or VPN state. A dual-SIM phone with an Indian SIM in the secondary slot only (primary empty or non-Indian) bypassed the check.

§4.3 detection ip-blockingkeyword-filtering in

India's app-filtering architecture is three-tiered: 136/220 apps (Tier 3) are inaccessible only via official app stores and trivially accessible after sideloading; 23 apps (Tier 2) additionally enforce IP geo-blocking; and 7 apps (Tier 1) combine IP geo-blocking with SIM-based locale detection. One outlier, ChessRush, restricted content at CDN edge servers serving Indian users, requiring both a foreign source IP and a foreign CDN edge server (via foreign DNS resolver) to bypass.

§4 (Summary), §4.3 evaluation ip-blocking in