There has been an almost complete shutdown of external network connectivity in Iran since about 2025-06-18 13:30 UTC (17:00 Iran Time). By strange happenstance, one IP address that has remained accessible is that of api.github.com, which means that people have been able to read and comment on GitHub issues during the shutdown. I manage a discussion forum that’s hosted on GitHub, which has become a venue for information sharing between the inside and outside about what the network conditions are like. This is a summary of my understanding of the situation so far.
The two main points are two significant IP addresses that have remained accessible and have facilitated some limited amount of communication:
- api.github.com (140.82.121.6). This lets people do things allowed by the GitHub REST API, which apparently includes logging in and reading/commenting on issues using a GitHub app (presumably https://github.com/mobile, not sure about https://github.com/apps/desktop). It does not include downloads from GitHub or even browsing the github.com web site.
- google.com (216.239.38.120). This IP address was not available during the shutdown at first, but became so around 2025-06-19 11:00 UTC. Through this IP address you can access many Google services, not just Google Search. It only requires setting some entries in the hosts file to make, e.g., maps.google.com resolve to 216.239.38.120. It does not require domain fronting – that is, there’s no SNI filter that permits only “google.com”.
This IODA graph shows measurements that reflect the shutdown.
https://ioda.inetintel.cc.gatech.edu/country/IR?from=1750118424&until=1750377624
- The rectangular dip in the “Google (Search)” series on 2025-06-17 was a more limited shutdown that preceded the current one.
https://infosec.exchange/@dougmadory/114699258567046111
Notice how, at this time, the “Active Probing” series remained high. - The current shutdown started at 2025-06-18 13:30. At that time, both the “Active Probing” and “Google (Search)” went almost to zero.
https://mastodon.social/@IODA/114704752451701595
There was one little blip in the “Active Probing” series a few hours later:
https://mastodon.social/@IODA/114706908958417608 - At about 2025-06-19 11:00, the “Google (Search)” suddenly returns to normal, while the “Active Probing” remains low. This appears to correspond with when the google.com IP address 216.239.38.120 became accessible.
This is the thread on the discussion forum I manage:
The same day the shutdown occurred, there was a post on the thread itself by someone saying the GitHub app was working for them:
https://github.com/net4people/bbs/issues/484#issuecomment-2985672840
I’m in iran and just got access to outside network using github app on android.
Idk how is this working but i need to replicate it on real vpn connection
https://github.com/net4people/bbs/issues/484#issuecomment-2987484989
Turns out api.github.com’s ip (140.82.121.6) is open for connections
On 2025-06-18, users reported that they were able to browse Google Search through google.com. Clicking the search results didn’t work, unless they were for websites in Iran.
https://github.com/net4people/bbs/issues/484#issuecomment-2988483200
Are people able to access Google Search?
only “google.com” opens. all other subdomains or google services are down. you can search in google.com only; but then only iranian websites opens.
Further experiments showed only “google.com” worked, not “www.google.com” (which resolves to a different IP address). But generally, you can access many Google services through the google.com IP address, either by editing the system hosts file, running a local DNS resolver, or using the --connect-to option in curl. We initially tried some experiments with domain fronting, but domain fronting is not required: you only need to be talking to the right server IP address.
https://github.com/net4people/bbs/issues/484#issuecomment-2988836609
Thanks for running the test. It looks like you need to add the
--ssl-revoke-best-effortoption:curl --ssl-revoke-best-effort --header "Host: amp-dev.cdn.ampproject.org" https://google.com/c/s/amp.dev/curl --ssl-revoke-best-effort --header "Host: www-aljazeera-net.cdn.ampproject.org" https://google.com/c/s/www.aljazeera.net/amp/sport/2025/6/19/%d9%86%d9%82%d9%84-%d9%85%d8%a8%d8%a7%d8%a8%d9%8a-%d9%86%d8%ac%d9%85-%d8%b1%d9%8a%d8%a7%d9%84-%d9%85%d8%af%d8%b1%d9%8a%d8%af-%d8%a5%d9%84%d9%89-%d8%a7%d9%84%d9%85%d8%b3%d8%aa%d8%b4%d9%81%d9%89What happening is, curl want to check the revocation status of the server TLS certificate. But because of the shutdown, the server that is used to check the certificate status is not reachable. That’s why the command failed before, “the revocation server was offline”. The --ssl-revoke-best-effort should let the command run, even if the revocation server cannot be reached.
I got the response back. It works great!
https://github.com/net4people/bbs/issues/484#issuecomment-2989129342
Setting maps.google.com to google.com’s ip in hosts file, allows me to open Google maps on Firefox!
https://github.com/net4people/bbs/issues/484#issuecomment-2989892386
there’s no sni blacklist, any sni works on ip from google.com
curl -vk --connect-to ::216.239.38.120 https://void.comreturns 404 in iran, the same as outside
The curl --connect-to trick has provided a way to download files, by uploading the files to Google Drive, then accessing drive.usercontent.google.com through the accessible IP address 216.239.38.120. It looks like this:
https://github.com/net4people/bbs/issues/485#issuecomment-2992413851
curl --connect-to ::216.239.38.120 --ssl-revoke-best-effort -L -o champa-client-darwin-amd64 "https://drive.usercontent.google.com/download?id=1ROCBSIsnat8uDQSlOFajuW2XAbeqNNZh&export=download&confirm=t"
The accessibility of the google.com IP address also means that the Google AMP Cache (cdn.ampproject.org) can also be accessed, which in turn enables limited proxying to other destinations. We have tried an AMP cache tunneling proxy, which works to some extent, but because of rate limits its speed and usefulness are limited.
https://github.com/net4people/bbs/issues/485
Champa is a censorship circumvention proxy that tunnels through an AMP cache. Because the IP address of google.com is currently reachable, you can use that IP address to reach an AMP cache, and then from the AMP cache reach any other service.
