Blocking Roundup: Summer 2026

Writing this while it's still warm — what I see on my own nodes and hear from peers in the trade over the last few weeks. This isn't a prophecy, it's a roundup: what actually tightened this summer, what gets hit, and how people are answering. By fall half of it will be stale, which is why I'm stamping the date.

This material is about engineering your own network infrastructure and is educational. You comply with the laws of your jurisdiction yourself.

The general temperature

The summer turned out jittery. Where earlier waves came in bursts — "rolled out a new signature, a month of quiet, another wave" — since May the pressure has become steady and ambient. TSPU no longer waits for big dates to switch something on: adjustments land quietly, region by region, often on weekends when nobody's watching. There's one practical conclusion from this — you monitor constantly, not "when clients start complaining." By the time the complaints come, you've already lost a week.

Second general observation: filtering has finally shifted from the "address" level to the "behavior" level. The plain IP blacklist still exists, but it stopped being the main weapon long ago. The main tool is connection statistics and active probing of what lives on the port. Whoever understood that a year ago sailed through the summer calmly.

What gets hit first

The order in which entries get killed this summer is fairly stable, and it's worth keeping in mind.

• Old protocols without masking. Plain Shadowsocks, VMess over WebSocket without TLS, anything that leaks characteristic lengths and timings — those are the first candidates. They get cut without a second look, because the risk of a false positive against ordinary web traffic is near zero.
• A broken or rare TLS fingerprint. If your ClientHello doesn't look like a live browser, you light up. This summer fingerprint recognition specifically got sharper: default uTLS profiles that passed a year ago now get caught more often.
• Datacenter subnets with a bad history. An entry on an IP from a subnet known entirely as VPN hosting gets cut by the batch. A neighbor got flagged — the whole block went down.
• Connections that are too "clean." It's a paradox, but a constant stream of even, long, symmetric sessions to the same port is itself a signal. A normal person doesn't browse like that.

What tightened specifically this summer

Three things I'd file under "new this season."

First, active probing got more aggressive. Earlier, port checks after a suspicious connection were rare and lazy. Now in some regions I see a fresh entry gets knocked on almost immediately, and knocked on with intent — not with a single empty request but in series, imitating different clients. Reality still holds against this, but only if the donor is genuine and live. A half-dead donor that sometimes doesn't answer itself now gives the node away faster.

Second, pressure on CDN fronting grew. What was a quiet harbor all last year started getting touched this summer: throttled in places, specific edges selectively cut elsewhere. This doesn't mean fronting is dead — it's still one of the best options — but "set it and forget it" no longer works. Keep a backup path.

Third, regionalization. The very same node this summer can work great from one region and be down from the neighboring one. Filters are tuned locally, and what you see from Moscow doesn't equal what a client beyond the Urals sees. Health has to be checked from several points, not from your one.

How operators are responding

Nothing exotic, but the toolkit has settled and it works.

First — going statistically boring. Reality with Vision as the base, a transport on top (XHTTP holds better than gRPC this summer), a donor from someone else's large network. The goal isn't "impenetrable" but "unremarkable": the less a node stands out against ordinary HTTPS, the longer it lives.

Second — a disposable entry and a protected exit. A cascade has finally become not a luxury but hygiene: the entry IP gets burned in batches and swapped painlessly, because the exit and the keys aren't touched. The client re-installs nothing, and you don't lose a night to a re-import.

Third — hot spares across different ASNs. Whoever keeps several pre-stood-up entries in non-overlapping networks rides out a block this summer as a routine moment, not an emergency. Keep it all in one ASN — and it goes down at once, by the subnet.

What to do right now

If I compress it to the point for this season: check that your donors are live and large; make sure the fingerprint imitates a real browser; set up monitoring from several regions, not from a single point; and prepare a backup entry in advance, not at the moment of the block. Everything else is detail on these four items.

The summer will show a couple more surprises, but the foundation doesn't change: be boring, separate the entry and exit functions, keep a spare. Those who do that will still be online in the fall.