Void Verge

Since Iran's internet was reopened by the government, extensive changes have been taking place across the country's internal network. After weeks of blackout, almost all methods that were used during that period have been documented and handed over to the authorities. The filtering system is preparing for the next phase of outages. Methods like DNS tunneling, MITM, and Domain Fronting will certainly no longer work in future blackouts. Additionally, the filtering authorities have taken significant steps to establish intermediary providers that offer foreign services to Iranians with severe restrictions, or to NAT essential websites that cannot use the previous methods. Under these conditions, publishing methods openly and publicly does nothing except make the filtering authorities' job easier. The mechanism needs to operate under the radar — closed-source and quiet. At the same time, Iran's internet mafia has gained even more power — a mafia consisting of individuals with "white internet" access, ISPs, and data centers that have started selling unlimited internet to VPN sellers for hundreds of millions of tomans through mechanisms like proxy services and dedicated NAT-enabled servers. The mafia has become so powerful that it's managed to steer Iran's Supreme Cyber Space Council toward keeping the internet more restricted to maximize their profits, despite the crisis and war conditions of the past weeks. Simple website hosting providers in Iran have become millionaire VPN sellers after just two months of blackout. We will continue collecting and publishing the necessary data in the coming weeks. If this situation continues, our next target must be the internet mafia in Iran. We hope these difficult days pass for all Iranians. The pain caused by internal enemies and thieves who rob people under the guise of war is far worse than war itself!

As we suspected, the Iranian government has begun rolling out internet whitelisting in a gradual, step-by-step manner. We believe this document will help you uncover the truth behind the operation and identify those responsible. It reveals exactly how the staged whitelisting allows censors to systematically discover and neutralize the remaining bypass techniques—detailing how they detect them and why they have chosen this precise method. It also contains several other valuable insights worth noting. Unfortunately ongoing infrastructure changes and continuous mass reloading of firewalls (which you see as 2 to 4 hour connection to outside on these days ) on every ISP are clear signs that a class-based national internet is now being implemented at the country-wide level. Although this may look like a security upgrade, it is more like moving into a house with a bomb already planted inside. The proof is the massive infrastructure shutdown they adopted from the US.

Another draft paper we found suggests that Iran is planning to control third-party applications such as X (Twitter), Telegram, and Instagram in order to influence public opinion and conduct what could be described as a cognitive war. Although these projects were initially introduced under positive or protective frameworks—appearing to aim at preventing external manipulation—they ultimately seem to offer more advanced methods of control. Much of this work has reportedly been carried out by universities in Tehran, whose names we are not disclosing. The projects have progressed through the use of AI platforms and teams of researchers, with the apparent goal of preventing people from organizing around ideas that conflict with official positions.

We also discovered concrete evidence in the leaked data that the regime has attempted to block public DNS servers on a large scale. According to the extracted configurations and Cloudflare Radar data (see attached image), they deployed strict DNS blocking rules. However, the documents clearly show that they failed to fully block DNS requests to the outside world. Most of their own servers collapsed during the first tests, forcing them to reroute traffic and rely on DNS forwarding instead. Meanwhile, several ISPs were unable to implement the blocking properly. We have published the relevant files below. You can scan them yourself and discover the servers and configurations.

After weeks of continuous internet shutdowns in Iran, we have decided to take action. We have split our team into two parallel projects to expose the regime’s horrific tactics against the Iranian people: Team 1 has extracted highly confidential government reports and internal orders. These documents reveal systematic strategies to: Control and manipulate public opinion Trick and trap citizens Hunt down Starlink terminals Target people selling VPN configurations Seize control of news channels and proxy groups Team 2 has focused on the mafia networks behind the “white internet” (filtered internet) business. They sell access to the poor at exorbitant prices while working hand-in-hand with the censorship infrastructure (TIC). They actively help block DNS and develop new filtering methods just to make their illegal business more profitable. So far, we have extracted over 750 gigabytes of sensitive data, including: Detailed logs and filtering strategies User profiling systems Internal orders to enforce nationwide censorship And much more... We are now carefully organizing and analyzing this massive archive. In the coming steps, we will publish key findings and develop effective strategies to bypass this digital oppression.

After weeks of continuous internet shutdowns in Iran, we have decided to take action. We have split our team into two parallel projects to expose the regime’s horrific tactics against the Iranian people: Team 1 has extracted highly confidential government reports and internal orders. These documents reveal systematic strategies to: Control and manipulate public opinion Trick and trap citizens Hunt down Starlink terminals Target people selling VPN configurations Seize control of news channels and proxy groups Team 2 has focused on the mafia networks behind the “white internet” (filtered internet) business. They sell access to the poor at exorbitant prices while working hand-in-hand with the censorship infrastructure (TIC). They actively help block DNS and develop new filtering methods just to make their illegal business more profitable. So far, we have extracted over 750 gigabytes of sensitive data, including: Detailed logs and filtering strategies User profiling systems Internal orders to enforce nationwide censorship And much more... We are now carefully organizing and analyzing this massive archive. In the coming steps, we will publish key findings and develop effective strategies to bypass this digital oppression.

After a few days of silence... We're back with something massive. Some fresh leaks coming...

Looks like somone need to pass network+ again... Below is a list of new dns servers list in TCP(port 53), which hasn't been restricted by firewall yet. With proper set-up (multiplexing, mtu and dns-size) you can make your dead connections alive again. We also add new UDP dns servers beside the list we published before that may help.

Th changes came back on TCi. Dns request to most of the sites get the same ip and They also started blocking othe dns-server even local ones.

Based on the traffic we observed in Iran, it appears that TCI has started implementing domain whitelisting on their DNS servers. This might be a configuration mistake, but according to our logs, since this morning most domains have been resolving to the internal IP 10.10.34.35. Some of the most frequently used domains were occasionally corrected, but many services such as bale.ai, zarebin.ir, and several others have still not been fixed.

The change is now completely applied and many ranges are open Scan and find them out