• HTTP/HTTPS focused blocking for some of the blocked domains
• Uses TurkTelekom IP (government) to present the page stating the domain is blocked.

DNS

• ISP's DNS server resolves government IPs for blocked domains.
• Won't manipulate 3rd party DNS servers.

Exceptions

• ISP DNS will resolve the real IP address for PrivateInternetAccess VPN despite being a blocked domain.

HTTP

• If a blocked domain appears on host header, it won't do anything

• ISP does not block the government IP address with blocked domain to present the page stating the domain is blocked.

  Government's Statement of the Blocked Domains

Exceptions

• If wikileaks.org/com appears on host header, it will reset the connection.

$ curl -vik --header "Host: wikileaks.org" 85.117.236.90
*   Trying 85.117.236.90:80...
* TCP_NODELAY set
* Connected to 85.117.236.90 (85.117.236.90) port 80 (#0)
> GET / HTTP/1.1
> Host: wikileaks.org
> User-Agent: curl/7.68.0
> Accept: */*
>
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer

HTTPS

• If a blocked domain appears on SNI, it won't do anything

Exceptions

• If wikileaks.org/com appears on SNI, it will reset the connection without looking at the IP address.

$ curl -vik --resolve wikileaks.org:443:85.117.236.90 <https://wikileaks.org>
* Added wikileaks.org:443:85.117.236.90 to DNS cache
* Hostname wikileaks.org was found in DNS cache
*   Trying 85.117.236.90:443...
* TCP_NODELAY set
* Connected to wikileaks.org (85.117.236.90) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: Connection reset by peer in connection to wikileaks.org:443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to wikileaks.org:443

• It just gets stuck for PrivateInternetAccess.

$ curl -vik <https://privateinternetaccess.com> -m 2
*   Trying 92.123.16.68:443...
* TCP_NODELAY set
* Connected to privateinternetaccess.com (92.123.16.68) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* Operation timed out after 2001 milliseconds with 0 out of 0 bytes received
* Closing connection 0
curl: (28) Operation timed out after 2001 milliseconds with 0 out of 0 bytes received