Since Iran's internet was reopened by the government, extensive changes have been taking place across the country's internal network. After weeks of blackout, almost all methods that were used during that period have been documented and handed over to the authorities. The filtering system is preparing for the next phase of outages. Methods like DNS tunneling, MITM, and Domain Fronting will certainly no longer work in future blackouts.

Additionally, the filtering authorities have taken significant steps to establish intermediary providers that offer foreign services to Iranians with severe restrictions, or to NAT essential websites that cannot use the previous methods.

Under these conditions, publishing methods openly and publicly does nothing except make the filtering authorities' job easier. The mechanism needs to operate under the radar — closed-source and quiet.

At the same time, Iran's internet mafia has gained even more power — a mafia consisting of individuals with "white internet" access, ISPs, and data centers that have started selling unlimited internet to VPN sellers for hundreds of millions of tomans through mechanisms like proxy services and dedicated NAT-enabled servers.

The mafia has become so powerful that it's managed to steer Iran's Supreme Cyber Space Council toward keeping the internet more restricted to maximize their profits, despite the crisis and war conditions of the past weeks.

Simple website hosting providers in Iran have become millionaire VPN sellers after just two months of blackout.

We will continue collecting and publishing the necessary data in the coming weeks. If this situation continues, our next target must be the internet mafia in Iran.

We hope these difficult days pass for all Iranians. The pain caused by internal enemies and thieves who rob people under the guise of war is far worse than war itself!