Complete returned record
{
"country_code": "VN",
"coverage_note": "No tool in VN cleared the try_first bar (success >= 0.70 AND confidence >= 0.70). The headline recommendation falls back to the highest-ranked tool. Consider a self-hosted WireGuard / OpenVPN endpoint on a private IP, which is invisible to OONI and not represented here.",
"do_not_share_card_without_caveats": true,
"endpoints": {
"info": "/v1/atlas/circumvention/info",
"leaderboard": "/v1/atlas/evasion/leaderboard",
"upstream_evasion_table": "/v1/atlas/evasion/VN"
},
"generated_at": "2026-10-26T06:00:14.987816+00:00",
"headline_basis": "fallback",
"headline_recommendation": {
"category": "anonymity-network",
"confidence": 0.99,
"n_total_probes": 645,
"rank_score": 0.4103,
"success_rate": 0.6264,
"tool_name": "Tor",
"tool_note": "Tor uses obfs4 by default. If obfs4 fails, switch to the Snowflake bridge from inside the Tor Browser settings. The OONI tor test does NOT differentiate transports, so this row is the aggregate.",
"tool_slug": "tor",
"verdict": "partial"
},
"honest_caveats": [
"PROBE SUCCESS != REAL-USER SUCCESS. DPI vendors increasingly rate-limit real client traffic while letting OONI / Voidly synthetic measurement probes through. Success rates here are an UPPER BOUND on what a real user will see.",
"Recommendations can become stale within hours. Censorship adapts. If a try_first tool stops working, the next probe rotation (cron daily 06:00 UTC) will catch it but you will see it before we do.",
"'Try first' is NOT 'safe'. It means 'highest measured success rate, highest probe confidence.' Operational security (unique device, throwaway account, no SIM, no DNS leak, etc.) is the USER's responsibility — none of that is captured here.",
"Domain-fronted tools (Snowflake, Lantern, Psiphon) are SYSTEMATICALLY UNDER-ESTIMATED. Bootstrap-domain probes do not measure the rotating tunnel endpoints those tools actually use.",
"Self-hosted WireGuard / OpenVPN on a private IP is INVISIBLE to OONI probes and is not represented here. If you have one, trust it over any commercial recommendation.",
"Tor rows roll up vanilla / obfs4 / Snowflake / Meek transports. Per-transport granularity needs raw OONI nettests, out of scope for v1.",
"DO NOT share this recommendation as a forum-shareable card without the caveat block. The do_not_share_card_without_caveats flag in the response is on by design."
],
"informational_disclaimer": "This endpoint is INFORMATIONAL, not a safety guarantee. Probe success is an upper bound on real-user success. User assumes the risk of any tool selected from this ranking. 'Try first' does not mean 'safe' — it means 'highest measured success, highest probe confidence.'",
"insufficient_coverage": false,
"lookback_days": 30,
"min_total_probes_floor": 100,
"n_tools_measured": 5,
"n_total_probes": 731,
"rank_formula": "success_rate * sqrt(confidence) * recency_decay",
"schema": "voidly-circumvention-recommendation/v1",
"tier_definitions": {
"avoid": {
"description": "High-confidence measurements show <10% probe success. Very likely blocked. Listed for transparency — do not trust the bootstrap path.",
"label": "Avoid",
"max_success_rate": 0.1,
"min_confidence": 0.7
},
"fallback": {
"description": "Either partial measured success (30%+) OR not enough probes to be sure. Worth trying if the try_first tools fail — but expect lower reliability.",
"label": "Fallback",
"max_confidence_for_uncertain": 0.5,
"min_success_rate_lower": 0.3
},
"try_first": {
"description": "High measured success rate AND high probe confidence. Still informational only — DPI vendors increasingly block real clients while letting measurement probes pass, so success_rate is an upper bound.",
"label": "Try first",
"min_confidence": 0.7,
"min_success_rate": 0.7
}
},
"tiers": {
"avoid": [
{
"category": "p2p-circumvention",
"confidence": 0.858,
"n_total_probes": 22,
"rank_score": 0,
"success_rate": 0,
"tool_name": "Lantern",
"tool_note": "Lantern bootstraps from getlantern.org but rotates endpoints aggressively after that. Bootstrap-domain block does not mean ongoing-connection block.",
"tool_slug": "lantern",
"verdict": "blocked"
},
{
"category": "vpn-proxy",
"confidence": 0.858,
"n_total_probes": 22,
"rank_score": 0,
"success_rate": 0,
"tool_name": "Psiphon",
"tool_note": "Psiphon ships a bundled server list — even if psiphon.ca is blocked, the app can usually bootstrap from cached entries.",
"tool_slug": "psiphon",
"verdict": "blocked"
},
{
"category": "commercial-vpn-aggregate",
"confidence": 0.839,
"n_total_probes": 21,
"rank_score": 0,
"success_rate": 0,
"tool_name": "Generic commercial VPN bootstrap",
"tool_note": "Aggregate over ProtonVPN, ExpressVPN, Mullvad, VPN Gate. Hides per-vendor variation. Look at the per-tool rows to see which specific vendor passes if any.",
"tool_slug": "generic-vpn",
"verdict": "blocked"
},
{
"category": "commercial-vpn",
"confidence": 0.839,
"n_total_probes": 21,
"rank_score": 0,
"success_rate": 0,
"tool_name": "ProtonVPN",
"tool_note": "Blocking protonvpn.com does NOT block all ProtonVPN tunnels. Individual WireGuard / OpenVPN endpoint IPs may stay reachable.",
"tool_slug": "protonvpn",
"verdict": "blocked"
}
],
"fallback": [
{
"category": "anonymity-network",
"confidence": 0.99,
"n_total_probes": 645,
"rank_score": 0.4103,
"success_rate": 0.6264,
"tool_name": "Tor",
"tool_note": "Tor uses obfs4 by default. If obfs4 fails, switch to the Snowflake bridge from inside the Tor Browser settings. The OONI tor test does NOT differentiate transports, so this row is the aggregate.",
"tool_slug": "tor",
"verdict": "partial"
}
],
"try_first": []
},
"tools_ranked": [
{
"block_rate": 0.3736,
"blocking_methods": {
"tor-blocking": 38
},
"category": "anonymity-network",
"confidence": 0.99,
"confidence_band": "high",
"domains_observed": [],
"first_observed": "2026-09-26T12:00:00Z",
"last_observed": "2026-10-05T18:00:00Z",
"n_blocked_probes": 241,
"n_successful_probes": 404,
"n_total_probes": 645,
"n_unique_asns": 0,
"rank_score": 0.4103,
"recency_decay": 0.6583,
"recency_decay_known": true,
"recency_decay_note": null,
"success_rate": 0.6264,
"tier": "fallback",
"tool_name": "Tor",
"tool_note": "Tor uses obfs4 by default. If obfs4 fails, switch to the Snowflake bridge from inside the Tor Browser settings. The OONI tor test does NOT differentiate transports, so this row is the aggregate.",
"tool_slug": "tor",
"verdict": "partial"
},
{
"block_rate": 1,
"blocking_methods": {
"dns-blocking": 7
},
"category": "p2p-circumvention",
"confidence": 0.858,
"confidence_band": "high",
"domains_observed": [
"getlantern.org"
],
"first_observed": "2026-09-27T00:00:00Z",
"last_observed": "2026-10-25T00:00:00Z",
"n_blocked_probes": 22,
"n_successful_probes": 0,
"n_total_probes": 22,
"n_unique_asns": 2,
"rank_score": 0,
"recency_decay": 0.9792,
"recency_decay_known": true,
"recency_decay_note": null,
"success_rate": 0,
"tier": "avoid",
"tool_name": "Lantern",
"tool_note": "Lantern bootstraps from getlantern.org but rotates endpoints aggressively after that. Bootstrap-domain block does not mean ongoing-connection block.",
"tool_slug": "lantern",
"verdict": "blocked"
},
{
"block_rate": 1,
"blocking_methods": {
"dns-blocking": 7
},
"category": "vpn-proxy",
"confidence": 0.858,
"confidence_band": "high",
"domains_observed": [
"psiphon.ca"
],
"first_observed": "2026-09-27T00:00:00Z",
"last_observed": "2026-10-25T00:00:00Z",
"n_blocked_probes": 22,
"n_successful_probes": 0,
"n_total_probes": 22,
"n_unique_asns": 2,
"rank_score": 0,
"recency_decay": 0.9792,
"recency_decay_known": true,
"recency_decay_note": null,
"success_rate": 0,
"tier": "avoid",
"tool_name": "Psiphon",
"tool_note": "Psiphon ships a bundled server list — even if psiphon.ca is blocked, the app can usually bootstrap from cached entries.",
"tool_slug": "psiphon",
"verdict": "blocked"
},
{
"block_rate": 1,
"blocking_methods": {
"dns-blocking": 7
},
"category": "commercial-vpn-aggregate",
"confidence": 0.839,
"confidence_band": "high",
"domains_observed": [
"protonvpn.com"
],
"first_observed": "2026-09-27T00:00:00Z",
"last_observed": "2026-10-25T00:00:00Z",
"n_blocked_probes": 21,
"n_successful_probes": 0,
"n_total_probes": 21,
"n_unique_asns": 2,
"rank_score": 0,
"recency_decay": 0.9792,
"recency_decay_known": true,
"recency_decay_note": null,
"success_rate": 0,
"tier": "avoid",
"tool_name": "Generic commercial VPN bootstrap",
"tool_note": "Aggregate over ProtonVPN, ExpressVPN, Mullvad, VPN Gate. Hides per-vendor variation. Look at the per-tool rows to see which specific vendor passes if any.",
"tool_slug": "generic-vpn",
"verdict": "blocked"
},
{
"block_rate": 1,
"blocking_methods": {
"dns-blocking": 7
},
"category": "commercial-vpn",
"confidence": 0.839,
"confidence_band": "high",
"domains_observed": [
"protonvpn.com"
],
"first_observed": "2026-09-27T00:00:00Z",
"last_observed": "2026-10-25T00:00:00Z",
"n_blocked_probes": 21,
"n_successful_probes": 0,
"n_total_probes": 21,
"n_unique_asns": 2,
"rank_score": 0,
"recency_decay": 0.9792,
"recency_decay_known": true,
"recency_decay_note": null,
"success_rate": 0,
"tier": "avoid",
"tool_name": "ProtonVPN",
"tool_note": "Blocking protonvpn.com does NOT block all ProtonVPN tunnels. Individual WireGuard / OpenVPN endpoint IPs may stay reachable.",
"tool_slug": "protonvpn",
"verdict": "blocked"
}
]
}