Iran.

{
  "age_hours": 23.46,
  "components_normalized": {
    "agreement": 0.6726,
    "classifier": 0.626,
    "dbscan": 1,
    "domain_div": 1,
    "forecast": 0.3635,
    "incident_rate": 0,
    "mobile_skew": 0.7245
  },
  "components_points": {
    "agreement": 8.41,
    "classifier": 23.48,
    "dbscan": 18.75,
    "domain_div": 12.5,
    "incident_rate": 0,
    "mobile_skew": 4.53
  },
  "country": "IR",
  "country_name": "Iran",
  "delta_vs_yesterday": 8.29,
  "ema_status": "warm",
  "generated_at": "2026-09-10T04:35:58.851132+00:00",
  "honest_caveats": [
    "Weights are hand-tuned, not learned end-to-end.",
    "The seven components are correlated — the weighted sum is not a pure information-theoretic average.",
    "'Intensity' is editorial framing. The metric is a censorship-risk-weighted average across live signals, not a direct user-facing measurement.",
    "Mobile-blocking skew is approximated from OONI test_name= URL params and gated to countries with at least 10 probes in the last 7 days.",
    "The first 3 days after rollout the smoothed series equals the raw score (cold start); deltas stabilize after that.",
    "Countries with sparse data (low OONI coverage, no recent incidents, no DBSCAN window) will float near 0 not because they are uncensored but because the signals collapse there."
  ],
  "interpretation": "smoothed_score is what to put in a headline; raw_score is today's component sum before EMA. delta_vs_yesterday is the movement (positive = censorship intensifying).",
  "previous_raw_score": 56.74,
  "previous_smoothed_score": 51.08,
  "raw_score": 67.66,
  "raw_signals": {
    "agreement_n_sources": null,
    "agreement_rate_2plus": 0.6726,
    "classifier_date": null,
    "classifier_label": 1,
    "classifier_probability": 0.626,
    "classifier_threshold": 0.5457,
    "classifier_version": "v3.3",
    "dbscan_anomaly_score_raw": 9.3862,
    "dbscan_date": "2026-09-09",
    "dbscan_is_anomaly": true,
    "forecast_key_drivers": [
      "Mahsa Amini Anniversary 2026 in 2d",
      "Mahsa Amini Anniversary 2026 in 3d",
      "Mahsa Amini Anniversary 2026 in 5d"
    ],
    "forecast_max_day": 6,
    "forecast_max_risk": 0.3635,
    "incidents_24h_censorship": 0,
    "incidents_24h_disruption": 0,
    "incidents_24h_weighted": 0,
    "mobile_skew": 0.3623,
    "ooni_mobile_probes_7d": 96,
    "ooni_probes_7d": 265,
    "unique_blocked_domains_30d": 825
  },
  "run_date": "2026-09-10",
  "schema": "voidly-score-country/v1",
  "sidecar_age_hr": 23.46,
  "smoothed_score": 59.37,
  "stale": false,
  "stale_after_hours": 26,
  "stale_field_note": "`stale` is three-valued: true / false / \"unknown\". \"unknown\" means the age could not be determined (missing or unparseable timestamp) and is NOT an assertion of freshness -- it is truthy on purpose so that a consumer testing the field falls to the cautious side. Check `stale_known` for a strict boolean and `stale_reason` for how the verdict was reached.",
  "stale_known": true,
  "stale_reason": "generated_at is 23.46h old, within the 26.00h threshold.",
  "weights": {
    "agreement": 0.125,
    "classifier": 0.375,
    "dbscan": 0.1875,
    "domain_div": 0.125,
    "incident_rate": 0.125,
    "mobile_skew": 0.0625
  }
}

{
  "country": "IR",
  "features_used": {
    "continent_Africa": 0,
    "continent_Americas": 0,
    "continent_Asia": 1,
    "continent_Europe": 0,
    "continent_Oceania": 0,
    "country_risk_tier": 1,
    "first_seen_month": 9,
    "first_seen_year": 2026,
    "prior_shutdowns_count_24mo": 161,
    "severity_critical": 1,
    "severity_warning": 0,
    "type_censorship": 1,
    "type_mixed": 0
  },
  "honest_caveats": [
    "model below promote floor (c=0.55, n=343) — treat as exploratory",
    "censoring rate in training set: 78%"
  ],
  "incident_type": "censorship",
  "iqr_days": 10,
  "median_days": 5,
  "median_hours": 120,
  "model": {
    "censoring_rate": 0.7842565597667639,
    "class": "RandomSurvivalForest",
    "feature_names": [
      "country_risk_tier",
      "first_seen_year",
      "first_seen_month",
      "prior_shutdowns_count_24mo",
      "continent_Africa",
      "continent_Americas",
      "continent_Asia",
      "continent_Europe",
      "continent_Oceania",
      "severity_critical",
      "severity_warning",
      "type_censorship",
      "type_mixed"
    ],
    "name": "shutdown_duration_rsf_v1",
    "trained_at": "2026-05-21T12:01:30.451711Z"
  },
  "model_c_index": 0.5455,
  "n_training_samples": 343,
  "p25_hours": 72,
  "p75_hours": 312,
  "promoted": false,
  "severity": "critical",
  "survival_curve_summary": [
    {
      "hours": 48,
      "survival_prob": 0.9
    },
    {
      "hours": 72,
      "survival_prob": 0.75
    },
    {
      "hours": 120,
      "survival_prob": 0.5
    },
    {
      "hours": 312,
      "survival_prob": 0.25
    },
    {
      "hours": 5952,
      "survival_prob": 0.1
    }
  ]
}

{
  "attribution": [
    {
      "p_follow_3d": 0.4945,
      "pair_coevents_365d": 72,
      "same_auth_cluster": false,
      "same_region": false,
      "trigger": "SG",
      "trigger_date": "2026-09-09T20:52:00"
    },
    {
      "p_follow_3d": 0.4652,
      "pair_coevents_365d": 61,
      "same_auth_cluster": false,
      "same_region": true,
      "trigger": "TR",
      "trigger_date": "2026-09-09T00:20:00"
    },
    {
      "p_follow_3d": 0.2854,
      "pair_coevents_365d": 82,
      "same_auth_cluster": false,
      "same_region": false,
      "trigger": "BD",
      "trigger_date": "2026-09-09T13:10:00"
    }
  ],
  "base_prior_3d": 0.4878,
  "base_rate_daily": 0.1626,
  "country": "IR",
  "follower_events_30d": 31,
  "generated_at": "2026-09-11T00:17:02.740601+00:00",
  "honest_caveats": [
    "Inherits contagion-chain v1 model uncertainty (primary horizon AUC ~0.67).",
    "24-48h is a TIGHT window. Most observed contagion patterns are 3-7d. This endpoint uses the shortest supported horizon (3d) as the closest proxy.",
    "A country on the watchlist does NOT mean it WILL block. The score is a relative ranking; absolute calibration of the underlying pairwise classifier is moderate (Brier ~0.14 at 3d).",
    "Trigger attribution is probabilistic (per-pair model output), not causal. Two countries spiking around the same time can also reflect shared upstream outages, regional politics, or coincidence.",
    "Noisy-OR aggregation assumes triggers act independently — this overestimates risk when multiple triggers share an underlying driver.",
    "Base-rate adjustment subtracts (base_daily * horizon) to discount countries that block every day anyway. This is a heuristic, not a matched counterfactual.",
    "With zero active triggers in the last 48h, watchlist is empty by design."
  ],
  "horizon_days": 3,
  "n_active_triggers": 3,
  "noisy_or": 0.8068,
  "rank": 22,
  "score": 0.319,
  "status": "on_watchlist",
  "trigger_window_hours": 48,
  "underlying_model": {
    "name": "contagion-chain-v1 (pairwise XGBoost)",
    "primary_horizon_auc_h7": 0.6696949571962517,
    "sidecar": "/opt/voidly-ai/ml-deploy/contagion_chain_v1.json"
  }
}

{
  "country": "IR",
  "generated_at": "2026-09-07T05:10:09.714350+00:00",
  "honest_caveat": "Similarity here is BEHAVIORAL, not political. Two countries are near each other because they BLOCK in similar ways — comparable method mix, target categories and temporal shape — which does NOT imply comparable governments, laws or intent. A stable democracy with seasonal sports-piracy blocks can sit near an authoritarian state if their measured blocking footprints rhyme. Feature vectors are SPARSE for low-coverage countries (flagged sparse=true, <3 of 5 behavioral feature families populated) — their neighbors are dominated by regime/continent/cohort one-hots and should be read with low confidence. The 2D graph projection (UMAP or PCA) compresses a 32-dimensional space to 2 and loses information — use the cosine `neighbors` list, not pixel distance in the projection, for any quantitative claim.",
  "method": "standardized-cosine + pca",
  "nearest": [
    {
      "continent": "Asia",
      "country": "CN",
      "risk_tier": 1,
      "similarity": 0.8724,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "PK",
      "risk_tier": 2,
      "similarity": 0.7978,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "TR",
      "risk_tier": 2,
      "similarity": 0.7958,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "MM",
      "risk_tier": 2,
      "similarity": 0.7772,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "AE",
      "risk_tier": 2,
      "similarity": 0.7659,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "TH",
      "risk_tier": 2,
      "similarity": 0.7647,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "SA",
      "risk_tier": 2,
      "similarity": 0.7172,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "BD",
      "risk_tier": 2,
      "similarity": 0.708,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "VN",
      "risk_tier": 2,
      "similarity": 0.705,
      "sparse": false
    },
    {
      "continent": "Asia",
      "country": "KZ",
      "risk_tier": 2,
      "similarity": 0.6723,
      "sparse": false
    }
  ],
  "query_meta": {
    "continent": "Asia",
    "country": "IR",
    "dtw_cohort": 3,
    "evidence_count": 12430,
    "feature_families_present": 5,
    "feature_families_total": 5,
    "risk_tier": 1,
    "sparse": false
  },
  "version": "v1"
}

{
  "distribution": {
    "A": 76,
    "B": 136,
    "C": 30,
    "F": 3
  },
  "filters": {
    "country": "IR",
    "incident_type": null
  },
  "rules": {
    "A": "else",
    "B": "n_sources >= 1 AND avg_confidence >= 0.7",
    "C": "n_sources >= 2 AND n_domains >= 3",
    "F": "duration_hours >= 24 AND n_sources >= 2"
  },
  "total": 253,
  "ungraded": 8
}

{
  "country_code": "IR",
  "coverage_note": "1 tool(s) cleared the try_first bar in IR, 0 in fallback, 4 in avoid. Headline is the highest-ranked try_first tool.",
  "do_not_share_card_without_caveats": true,
  "endpoints": {
    "info": "/v1/atlas/circumvention/info",
    "leaderboard": "/v1/atlas/evasion/leaderboard",
    "upstream_evasion_table": "/v1/atlas/evasion/IR"
  },
  "generated_at": "2026-09-10T06:00:04.838214+00:00",
  "headline_basis": "try_first",
  "headline_recommendation": {
    "category": "anonymity-network",
    "confidence": 0.99,
    "n_total_probes": 3769,
    "rank_score": 0.7699,
    "success_rate": 0.7803,
    "tool_name": "Tor",
    "tool_note": "Tor uses obfs4 by default. If obfs4 fails, switch to the Snowflake bridge from inside the Tor Browser settings. The OONI tor test does NOT differentiate transports, so this row is the aggregate.",
    "tool_slug": "tor",
    "verdict": "partial"
  },
  "honest_caveats": [
    "PROBE SUCCESS != REAL-USER SUCCESS. DPI vendors increasingly rate-limit real client traffic while letting OONI / Voidly synthetic measurement probes through. Success rates here are an UPPER BOUND on what a real user will see.",
    "Recommendations can become stale within hours. Censorship adapts. If a try_first tool stops working, the next probe rotation (cron daily 06:00 UTC) will catch it but you will see it before we do.",
    "'Try first' is NOT 'safe'. It means 'highest measured success rate, highest probe confidence.' Operational security (unique device, throwaway account, no SIM, no DNS leak, etc.) is the USER's responsibility — none of that is captured here.",
    "Domain-fronted tools (Snowflake, Lantern, Psiphon) are SYSTEMATICALLY UNDER-ESTIMATED. Bootstrap-domain probes do not measure the rotating tunnel endpoints those tools actually use.",
    "Self-hosted WireGuard / OpenVPN on a private IP is INVISIBLE to OONI probes and is not represented here. If you have one, trust it over any commercial recommendation.",
    "Tor rows roll up vanilla / obfs4 / Snowflake / Meek transports. Per-transport granularity needs raw OONI nettests, out of scope for v1.",
    "DO NOT share this recommendation as a forum-shareable card without the caveat block. The do_not_share_card_without_caveats flag in the response is on by design."
  ],
  "informational_disclaimer": "This endpoint is INFORMATIONAL, not a safety guarantee. Probe success is an upper bound on real-user success. User assumes the risk of any tool selected from this ranking. 'Try first' does not mean 'safe' — it means 'highest measured success, highest probe confidence.'",
  "insufficient_coverage": false,
  "lookback_days": 30,
  "min_total_probes_floor": 100,
  "n_tools_measured": 5,
  "n_total_probes": 4568,
  "rank_formula": "success_rate * sqrt(confidence) * recency_decay",
  "schema": "voidly-circumvention-recommendation/v1",
  "tier_definitions": {
    "avoid": {
      "description": "High-confidence measurements show <10% probe success. Very likely blocked. Listed for transparency — do not trust the bootstrap path.",
      "label": "Avoid",
      "max_success_rate": 0.1,
      "min_confidence": 0.7
    },
    "fallback": {
      "description": "Either partial measured success (30%+) OR not enough probes to be sure. Worth trying if the try_first tools fail — but expect lower reliability.",
      "label": "Fallback",
      "max_confidence_for_uncertain": 0.5,
      "min_success_rate_lower": 0.3
    },
    "try_first": {
      "description": "High measured success rate AND high probe confidence. Still informational only — DPI vendors increasingly block real clients while letting measurement probes pass, so success_rate is an upper bound.",
      "label": "Try first",
      "min_confidence": 0.7,
      "min_success_rate": 0.7
    }
  },
  "tiers": {
    "avoid": [
      {
        "category": "vpn-proxy",
        "confidence": 0.99,
        "n_total_probes": 273,
        "rank_score": 0.0785,
        "success_rate": 0.0806,
        "tool_name": "Psiphon",
        "tool_note": "Psiphon ships a bundled server list — even if psiphon.ca is blocked, the app can usually bootstrap from cached entries.",
        "tool_slug": "psiphon",
        "verdict": "blocked"
      },
      {
        "category": "commercial-vpn-aggregate",
        "confidence": 0.99,
        "n_total_probes": 174,
        "rank_score": 0.0616,
        "success_rate": 0.0632,
        "tool_name": "Generic commercial VPN bootstrap",
        "tool_note": "Aggregate over ProtonVPN, ExpressVPN, Mullvad, VPN Gate. Hides per-vendor variation. Look at the per-tool rows to see which specific vendor passes if any.",
        "tool_slug": "generic-vpn",
        "verdict": "blocked"
      },
      {
        "category": "commercial-vpn",
        "confidence": 0.99,
        "n_total_probes": 174,
        "rank_score": 0.0616,
        "success_rate": 0.0632,
        "tool_name": "ProtonVPN",
        "tool_note": "Blocking protonvpn.com does NOT block all ProtonVPN tunnels. Individual WireGuard / OpenVPN endpoint IPs may stay reachable.",
        "tool_slug": "protonvpn",
        "verdict": "blocked"
      },
      {
        "category": "p2p-circumvention",
        "confidence": 0.99,
        "n_total_probes": 178,
        "rank_score": 0.0602,
        "success_rate": 0.0618,
        "tool_name": "Lantern",
        "tool_note": "Lantern bootstraps from getlantern.org but rotates endpoints aggressively after that. Bootstrap-domain block does not mean ongoing-connection block.",
        "tool_slug": "lantern",
        "verdict": "blocked"
      }
    ],
    "fallback": [],
    "try_first": [
      {
        "category": "anonymity-network",
        "confidence": 0.99,
        "n_total_probes": 3769,
        "rank_score": 0.7699,
        "success_rate": 0.7803,
        "tool_name": "Tor",
        "tool_note": "Tor uses obfs4 by default. If obfs4 fails, switch to the Snowflake bridge from inside the Tor Browser settings. The OONI tor test does NOT differentiate transports, so this row is the aggregate.",
        "tool_slug": "tor",
        "verdict": "partial"
      }
    ]
  },
  "tools_ranked": [
    {
      "block_rate": 0.2197,
      "blocking_methods": {
        "tor-blocking": 118
      },
      "category": "anonymity-network",
      "confidence": 0.99,
      "confidence_band": "high",
      "domains_observed": [],
      "first_observed": "2026-08-11T12:00:00Z",
      "last_observed": "2026-09-09T18:00:00Z",
      "n_blocked_probes": 828,
      "n_successful_probes": 2941,
      "n_total_probes": 3769,
      "n_unique_asns": 0,
      "rank_score": 0.7699,
      "recency_decay": 0.9917,
      "recency_decay_known": true,
      "recency_decay_note": null,
      "success_rate": 0.7803,
      "tier": "try_first",
      "tool_name": "Tor",
      "tool_note": "Tor uses obfs4 by default. If obfs4 fails, switch to the Snowflake bridge from inside the Tor Browser settings. The OONI tor test does NOT differentiate transports, so this row is the aggregate.",
      "tool_slug": "tor",
      "verdict": "partial"
    },
    {
      "block_rate": 0.9194,
      "blocking_methods": {
        "dns-blocking": 9,
        "http-blocking-tcp-reset": 9,
        "http-blocking-timeout": 3
      },
      "category": "vpn-proxy",
      "confidence": 0.99,
      "confidence_band": "high",
      "domains_observed": [
        "psiphon.ca"
      ],
      "first_observed": "2026-08-12T00:00:00Z",
      "last_observed": "2026-09-09T00:00:00Z",
      "n_blocked_probes": 251,
      "n_successful_probes": 22,
      "n_total_probes": 273,
      "n_unique_asns": 2,
      "rank_score": 0.0785,
      "recency_decay": 0.9792,
      "recency_decay_known": true,
      "recency_decay_note": null,
      "success_rate": 0.0806,
      "tier": "avoid",
      "tool_name": "Psiphon",
      "tool_note": "Psiphon ships a bundled server list — even if psiphon.ca is blocked, the app can usually bootstrap from cached entries.",
      "tool_slug": "psiphon",
      "verdict": "blocked"
    },
    {
      "block_rate": 0.9368,
      "blocking_methods": {
        "dns-blocking": 9,
        "http-blocking-tcp-reset": 9
      },
      "category": "commercial-vpn-aggregate",
      "confidence": 0.99,
      "confidence_band": "high",
      "domains_observed": [
        "protonvpn.com"
      ],
      "first_observed": "2026-08-12T00:00:00Z",
      "last_observed": "2026-09-09T00:00:00Z",
      "n_blocked_probes": 163,
      "n_successful_probes": 11,
      "n_total_probes": 174,
      "n_unique_asns": 2,
      "rank_score": 0.0616,
      "recency_decay": 0.9792,
      "recency_decay_known": true,
      "recency_decay_note": null,
      "success_rate": 0.0632,
      "tier": "avoid",
      "tool_name": "Generic commercial VPN bootstrap",
      "tool_note": "Aggregate over ProtonVPN, ExpressVPN, Mullvad, VPN Gate. Hides per-vendor variation. Look at the per-tool rows to see which specific vendor passes if any.",
      "tool_slug": "generic-vpn",
      "verdict": "blocked"
    },
    {
      "block_rate": 0.9368,
      "blocking_methods": {
        "dns-blocking": 9,
        "http-blocking-tcp-reset": 9
      },
      "category": "commercial-vpn",
      "confidence": 0.99,
      "confidence_band": "high",
      "domains_observed": [
        "protonvpn.com"
      ],
      "first_observed": "2026-08-12T00:00:00Z",
      "last_observed": "2026-09-09T00:00:00Z",
      "n_blocked_probes": 163,
      "n_successful_probes": 11,
      "n_total_probes": 174,
      "n_unique_asns": 2,
      "rank_score": 0.0616,
      "recency_decay": 0.9792,
      "recency_decay_known": true,
      "recency_decay_note": null,
      "success_rate": 0.0632,
      "tier": "avoid",
      "tool_name": "ProtonVPN",
      "tool_note": "Blocking protonvpn.com does NOT block all ProtonVPN tunnels. Individual WireGuard / OpenVPN endpoint IPs may stay reachable.",
      "tool_slug": "protonvpn",
      "verdict": "blocked"
    },
    {
      "block_rate": 0.9382,
      "blocking_methods": {
        "dns-blocking": 9,
        "http-blocking-tcp-reset": 9
      },
      "category": "p2p-circumvention",
      "confidence": 0.99,
      "confidence_band": "high",
      "domains_observed": [
        "getlantern.org"
      ],
      "first_observed": "2026-08-12T00:00:00Z",
      "last_observed": "2026-09-09T00:00:00Z",
      "n_blocked_probes": 167,
      "n_successful_probes": 11,
      "n_total_probes": 178,
      "n_unique_asns": 2,
      "rank_score": 0.0602,
      "recency_decay": 0.9792,
      "recency_decay_known": true,
      "recency_decay_note": null,
      "success_rate": 0.0618,
      "tier": "avoid",
      "tool_name": "Lantern",
      "tool_note": "Lantern bootstraps from getlantern.org but rotates endpoints aggressively after that. Bootstrap-domain block does not mean ongoing-connection block.",
      "tool_slug": "lantern",
      "verdict": "blocked"
    }
  ]
}