Thank you @TheRambotnik, that’s very informative.
We can’t determine whether the ISP DNS resolver lies, since the system resolver tested doesn’t seem to be the one provided by the ISP (different country and AS).
It seems there’s no DNS injection, so using a third-party resolver should bypass DNS-based censorship, if any.
TLS connections seem to be blocked based on the SNI. I would guess packet dropping, causing the timeouts.
I’m surprised that GoodbyeDPI doesn’t work, since it’s supposed to help with SNI-based blocking. It would be nice to collect evidence on whether GoodByeDPI works. Perhaps you need to combine it with a third party DNS resolver to make it work. Or perhaps the government has indeed some advanced equipment.
The HTTP injection seems to be real. Even though those Twitter domains normally return a 404 without a path, they don’t return any content. The HTML you got is likely a block page, and can be used as a fingerprint to detect other blocked websites.
