After weeks of continuous internet shutdowns in Iran, we have decided to take action.
We have split our team into two parallel projects to expose the regime’s horrific tactics against the Iranian people:
Team 1 has extracted highly confidential government reports and internal orders. These documents reveal systematic strategies to:

Control and manipulate public opinion
Trick and trap citizens
Hunt down Starlink terminals
Target people selling VPN configurations
Seize control of news channels and proxy groups

Team 2 has focused on the mafia networks behind the “white internet” (filtered internet) business. They sell access to the poor at exorbitant prices while working hand-in-hand with the censorship infrastructure (TIC). They actively help block DNS and develop new filtering methods just to make their illegal business more profitable.
So far, we have extracted over 750 gigabytes of sensitive data, including:

Detailed logs and filtering strategies
User profiling systems
Internal orders to enforce nationwide censorship
And much more...

We are now carefully organizing and analyzing this massive archive. In the coming steps, we will publish key findings and develop effective strategies to bypass this digital oppression.

We also discovered concrete evidence in the leaked data that the regime has attempted to block public DNS servers on a large scale.
According to the extracted configurations and Cloudflare Radar data (see attached image), they deployed strict DNS blocking rules. However, the documents clearly show that they failed to fully block DNS requests to the outside world.
Most of their own servers collapsed during the first tests, forcing them to reroute traffic and rely on DNS forwarding instead. Meanwhile, several ISPs were unable to implement the blocking properly.
We have published the relevant files below. You can scan them yourself and discover the servers and configurations.

Another draft paper we found suggests that Iran is planning to control third-party applications such as X (Twitter), Telegram, and Instagram in order to influence public opinion and conduct what could be described as a cognitive war. Although these projects were initially introduced under positive or protective frameworks—appearing to aim at preventing external manipulation—they ultimately seem to offer more advanced methods of control. Much of this work has reportedly been carried out by universities in Tehran, whose names we are not disclosing. The projects have progressed through the use of AI platforms and teams of researchers, with the apparent goal of preventing people from organizing around ideas that conflict with official positions.

As we suspected, the Iranian government has begun rolling out internet whitelisting in a gradual, step-by-step manner. We believe this document will help you uncover the truth behind the operation and identify those responsible.

It reveals exactly how the staged whitelisting allows censors to systematically discover and neutralize the remaining bypass techniques—detailing how they detect them and why they have chosen this precise method. It also contains several other valuable insights worth noting.

Unfortunately ongoing infrastructure changes and continuous mass reloading of firewalls (which you see as 2 to 4 hour connection to outside on these days ) on every ISP are clear signs that a class-based national internet is now being implemented at the country-wide level.

Although this may look like a security upgrade, it is more like moving into a house with a bomb already planted inside. The proof is the massive infrastructure shutdown they adopted from the US.

Since Iran's internet was reopened by the government, extensive changes have been taking place across the country's internal network. After weeks of blackout, almost all methods that were used during that period have been documented and handed over to the authorities. The filtering system is preparing for the next phase of outages. Methods like DNS tunneling, MITM, and Domain Fronting will certainly no longer work in future blackouts.

Additionally, the filtering authorities have taken significant steps to establish intermediary providers that offer foreign services to Iranians with severe restrictions, or to NAT essential websites that cannot use the previous methods.

Under these conditions, publishing methods openly and publicly does nothing except make the filtering authorities' job easier. The mechanism needs to operate under the radar — closed-source and quiet.

At the same time, Iran's internet mafia has gained even more power — a mafia consisting of individuals with "white internet" access, ISPs, and data centers that have started selling unlimited internet to VPN sellers for hundreds of millions of tomans through mechanisms like proxy services and dedicated NAT-enabled servers.

The mafia has become so powerful that it's managed to steer Iran's Supreme Cyber Space Council toward keeping the internet more restricted to maximize their profits, despite the crisis and war conditions of the past weeks.

Simple website hosting providers in Iran have become millionaire VPN sellers after just two months of blackout.

We will continue collecting and publishing the necessary data in the coming weeks. If this situation continues, our next target must be the internet mafia in Iran.

We hope these difficult days pass for all Iranians. The pain caused by internal enemies and thieves who rob people under the guise of war is far worse than war itself!