Censorship Diagnostic

Find out what is actually filtered between you and the internet — locally, in your browser, in seconds.

Show my IP/ASN in the responseAlways anonymised with a hashed IP in our analytics. Toggle controls only what's echoed back to the page.

HOW IT WORKS

Four browser-native probes per target plus a self-fingerprint check

DNS PROBE

Compare resolved IPs across four DoH providers

TCP / TLS PROBE

WebSocket handshake to detect IP and TLS DPI

HTTP PROBE

Image + opaque fetch for stub-pages and HTTP-layer blocks

AGGREGATE

Confidence-calibrated verdict with additive flags

How Internet Censorship Actually Looks From the Browser

Internet censorship doesn't usually announce itself. The browser shows a connection error, a hung tab, a redirect to a 'this site is blocked' page, or a slow load that never finishes. Five different things look the same in the address bar. They're caused by very different mechanisms at different layers of the network stack. A typical user complaint sounds like 'site X doesn't work in country Y'. The complaint is a single bit. The reality is layered: DNS-level blocks happen first, TCP/IP blocks happen next, TLS blocks happen during handshake, HTTP-layer redirects come at the end. Each implementation choice leaves a different signature. TSPU in Russia favours TLS-DPI by SNI. China's GFW combines DNS poisoning with TCP RST injection. Iran's SHARE uses HTTP-layer redirects to a state-rendered stub for some categories of content. None of those look identical from inside the browser. A browser-native diagnostic can cover most of this without an extension or a VPN. Standard web APIs (DoH, WebSocket, opaque fetch, image load) probe each layer in sequence. Twelve verdict categories plus four orthogonal flags is what a serious test surfaces. A 'site is blocked' yes-or-no is what most testers surface. The gap between those two outputs is the entire diagnostic. Sections below: the layered picture of what 'blocked' means, the forensic signatures of the major censorship implementations, and what a browser test can and can't see compared to network-vantage probes like OONI.

Why 'Blocked' Needs Layers

The four-layer picture, ordered by where in the network stack the block happens. DNS blocking is the cheapest implementation. The state-mandated ISP resolver returns NXDOMAIN, a sinkhole IP (often 0.0.0.0 or a state-run informational page), or a poisoned IP that points to a stub. Cheap because no per-packet inspection is required: ISPs configure their DNS servers once and the block applies to every customer using ISP DNS by default. Easy to bypass since switching to 1.1.1.1 or 8.8.8.8 makes the resolver lies stop. Russian ISPs leaned on this until around 2020, when bypass became universal. China still uses it heavily, but only as one layer among several. The diagnostic signature: query four independent DoH providers (Cloudflare, Google, Quad9, Mullvad) and one ISP-default DNS. If the ISP DNS returns IPs that none of the DoH providers return, it's a DNS rewrite. If the ISP DNS returns NXDOMAIN while DoH returns valid IPs, it's a DNS block. If all four DoH providers return the same IP and the ISP also returns it, DNS isn't involved. IP-level blocking sits at the next layer. Routes to specific IP addresses are dropped at the carrier level. SYN packets to the destination get no response, or a TCP RST is injected to terminate the handshake. This is what 'TCP RESET' verdicts catch. Implementation: every packet hitting the carrier's edge gets checked against a blocklist. Matching packets get dropped or RST-injected. Costlier than DNS blocking but still cheap because no payload inspection is needed. TLS blocking is where modern censorship lives. The blocker doesn't drop the SYN; it lets TCP complete, then watches the TLS ClientHello for an SNI it doesn't like, and at that moment injects a TCP RST or drops the rest of the connection. Deep packet inspection but only at the SNI level, which is plain text in TLS 1.2 and 1.3. Encrypted Client Hello fixes this, but adoption is still partial. A TLS-DPI block looks like 'connection succeeded, then died mid-handshake'. The diagnostic catches it as a TLS_BLOCK verdict by completing TCP successfully but failing the TLS layer specifically. HTTP-layer blocking is the cosmetic layer. The connection completes all the way to a server, but the server is the censor's server, not the destination. The user sees a stub page in their local language. The diagnostic catches it via image-load probes that complete with a payload but the wrong payload, or via HTTP_STUB classification when a known stub page text is detected. Throttling sits orthogonal to all four. Traffic completes but slowly enough that pages time out. Russia's 2021 Twitter throttling was the famous example: connections worked but rate-limited to roughly 10kbps, making the platform unusable without technically blocking it. The diagnostic detects throttling as a separate flag because it can apply to working sites, blocked sites, or sites that are technically permitted but operationally degraded. Same way a hospital triage line can be slow because the system is overloaded, slow because the patient was specifically deprioritised, or slow because someone forgot to bring the chart up. The reason matters; the symptom looks the same.

Three Implementations, Three Signatures

TSPU (Russia, 2021-present). Hardware DPI boxes installed at every Tier-1 ISP under Roskomnadzor supervision. The boxes do TLS-SNI matching and inject TCP RST when a flagged SNI hits the wire. Per-packet inspection at IX-scale traffic is expensive, which is why Russia generally targets specific SNIs rather than full IP-block lists. Twitter's throttle in 2021 used the same hardware to deliberately corrupt packets in a way that Twitter's TCP retried but never completed. Modern signature: connections to flagged SNIs RST'd mid-handshake, often with a 1-2 second pause before the RST (suggesting an inline rule lookup). DNS poisoning is rare in 2026 because Russian ISPs assume users have already moved off ISP DNS. GFW (China, 1998-present). Layered censorship combining DNS poisoning, IP blocklisting, TCP RST injection, TLS-SNI matching, and HTTP keyword filtering. The Great Firewall is the only major implementation that uses keyword filtering inside HTTP (not just SNI), which can interrupt page content even after the connection succeeds. The DNS poisoning layer is unusual: GFW returns plausible-but-wrong IPs that route to GFW-controlled servers, so a misconfigured client that ignores TTLs can cache a bad IP indefinitely. Same trick as a forged street sign that points 'this way to City Hall' but actually leads to an empty lot the city built specifically to absorb the foot traffic. Modern signature: any DNS query to a Chinese resolver for a blocked domain returns a different IP than any DoH provider; TCP connections to that returned IP succeed; TLS handshakes to flagged SNIs RST with a forged TCP-level reset that has invalid TCP options. ECH (Encrypted Client Hello) was specifically targeted in late 2024 and GFW now drops connections that include the ECH extension entirely. SHARE (Iran, 2019-present). Layered like GFW but with stronger reliance on HTTP-layer stub pages and DNS hijacking. Iranian ISPs run state-mandated DNS that rewrites blocked domains to one of several state pages. Some categories of content (HTTP-only, no TLS) are intercepted at the HTTP layer and redirected with a 302 to peyvandha.ir, the official 'this site is blocked' notice. TLS handshakes to blocked sites typically fail at the SNI layer, similar to TSPU. The signature is the combination: DoH lookup returns one IP, ISP DNS returns a different IP, HTTP probe to the DoH IP returns the destination, HTTP probe to the ISP IP returns peyvandha.ir HTML. OONI Probe runs from network vantage points; a browser diagnostic runs from the user's vantage. The two see different things. OONI catches what's blocked at the carrier edge, a browser test catches what reaches the user. They agree on most blocks and disagree on edge cases (corporate filters, school networks, regional carrier variance, time-of-day rules during elections or protests).

What the Browser Sees and What It Can't

A browser-native test has visibility limits worth being explicit about. What it can see: - DNS-layer differences across DoH providers (Cloudflare, Google, Quad9, Mullvad) plus the system resolver. Discrepancies are unambiguous. - TCP reachability to specific IPs via WebSocket handshake. WS connections that fail with TCP-level errors (vs TLS errors) distinguish IP_BLOCK from TLS_BLOCK. - TLS-layer fingerprint via JA4 self-check. Tells the user if the TLS connection their browser thinks it's making is the same TLS connection that actually arrived at the server. Mismatch means MITM. - HTTP-layer responses via opaque fetch and image load. The image load returns whether the response was decodable as an image (the destination's actual content) or not (a text/HTML stub, an error page, a 0-byte response). - Throttling via timing comparisons. If control sites are slow and blocked sites are slow, it's network-level throttling. If only one is slow, it's targeted. - DoH availability per provider. If 1.1.1.1 over HTTPS works and 8.8.8.8 over HTTPS doesn't, the censor is targeting specific DoH endpoints. This happened in Russia during 2024 with several Quad9 ranges. What it can't see: - Carrier-level routing decisions. If two ISPs in the same country route differently to the same destination, the test only sees the user's ISP. OONI sees more by aggregating across vantages. Like trying to diagnose a city's water-supply problem from a single tap: useful, telling, but the city has hundreds of taps and the problem might live somewhere else entirely. - Time-of-day blocks invoked during protests, elections, or specific events. A test run at noon misses the 8pm block. Repeated tests across a day capture this; one-shot tests don't. - Mobile-vs-fixed-line variance. Mobile carriers in some countries apply different filtering than fixed-line ISPs from the same parent operator. The test sees whichever connection it ran on. - Browser-extension interference. The CLIENT_BLOCKING_SUSPECTED flag fires when behaviour suggests an ad-blocker or privacy extension intercepted requests. The test can flag the suspicion but can't disable the extension to confirm. - Encrypted Client Hello status. ECH is rolling out in 2025-2026 for Cloudflare-fronted sites. Some censors block ECH by detecting the extension; others let it through. The test can detect when an SNI-based block stops working, suggesting ECH is now in play, but per-handshake ECH state isn't exposed to JavaScript. The right way to read a browser-vantage censorship test: it's a high-confidence answer for the user's specific connection at the moment of the test. It's a noisy answer for 'what's blocked in country X' because country X has many networks, many time-of-day variations, and many implementation tiers. For population-level censorship measurement, network-vantage probes (OONI, Censored Planet, Tor's anti-censorship telemetry) are the right tool. For 'why isn't this site working from my laptop right now', a layered browser diagnostic is exactly the right tool, and it's the only one that catches the long tail of edge-case blocks that don't make the OONI dataset.

FREQUENTLY ASKED QUESTIONS

Does this need an extension or a VPN?

No. The diagnostic runs entirely inside your browser — DoH queries, WebSocket probes, image loads, STUN reachability, all via standard web APIs. No install, no extension, no VPN required.

What does "likely network shutdown" mean?

When every DoH provider is unreachable AND every control target fails simultaneously, the most plausible cause is that the local network is cut off entirely. The diagnostic reports this rather than mis-attributing it to censorship.

Why are flags additive instead of overriding the verdict?

Throttling and TLS interception are orthogonal to whether content is being blocked. A connection can be throttled AND blocked, or normal speed AND blocked. Reporting them as separate badges keeps the diagnosis precise.

All our tests

Run the full WHOX toolkit from one place: leak checks, fingerprint probes, network diagnostics, reputation lookups, and privacy failure tests.