Key takeaways
Overview
I work with a team that monitors Iranian internet censorship. Since mid-2025 I've been systematically testing VPN protocols from inside Iran — running test devices on IRANCELL, MCI (Hamrah Aval), and RighTel networks. What follows is six months of empirical data, not theoretical analysis. I'll tell you what survives Iran's active probing infrastructure, what doesn't, and why.
Note: All testing was conducted for research purposes. This article is for users who need to understand what tools are available for legitimate communication.
The State of Telegram in Iran 2026
Telegram has been officially blocked in Iran since 2018 — initially following protests, maintained since. Despite this, Telegram has approximately 40–50 million active Iranian users, who access it via VPN. This makes Iran one of the largest VPN-dependent Telegram userbases in the world.
The blocking is not uniform or absolute. During 'normal' periods, moderate filtering allows some VPN protocols to work reliably. During escalation periods (protests, political events), filtering intensifies dramatically. During complete shutdowns (January 2026: approximately 72 hours of near-total blackout), no VPN is reliably effective.
Iran's Active Probing: What It Is and Why It Matters
Most discussions of VPN blocking focus on passive detection — the censorship system sees traffic and decides whether to block it. Iran's FATA (Iranian Cyber Police) and the filtering infrastructure also employ active probing: the system sends connection attempts TO suspected proxy servers, testing how they respond.
Active probing breaks many VPN protocols that survive passive detection
- A WireGuard server actively probed: responds with WireGuard handshake → immediately identified and blocked
- An OpenVPN server probed: responds with OpenVPN TLS behavior → identified
- A Shadowsocks server probed: with recent detection algorithms, identified via entropy analysis within minutes
- A VLESS Reality server probed: responds like a legitimate HTTPS website (microsoft.com) → probe concludes 'this is a normal web server' → moves on
The active probe can't distinguish a Reality server from a real Microsoft server because the Reality protocol is designed to respond identically to how Microsoft's real server responds. The private keypair (pbk/shortId in the VLESS configuration) is what allows legitimate clients to establish the actual tunnel — the probe never gets that far.
Six Months of Test Results
| Protocol | IRANCELL | MCI (Hamrah Aval) | RighTel |
|---|---|---|---|
| Active Probe Survival | Notes | VLESS Reality (INFOCROSS) | ✅ Stable |
| ✅ Stable | ✅ Stable | ✅ Survives | Best managed option tested |
| VLESS xHTTP | ✅ Stable | ✅ Stable | ✅ Stable |
| ✅✅ Very robust | More complex self-hosted setup | Psiphon | ⚠️ Variable |
| ⚠️ Variable | ⚠️ Variable | ⚠️ 2–4 hr sessions | Free but reconnects required |
| Lantern | ⚠️ Variable | ❌ Often fails | ⚠️ Variable |
| ⚠️ Inconsistent | Free, unreliable in testing | Tor (obfs4) | ⚠️ Slow |
| ⚠️ Slow | ⚠️ Slow | ⚠️ Detectable | Usable for text, not media |
| WireGuard (standard) | ❌ Instant block | ❌ Instant block | ❌ Instant block |
| ❌ 3–5 seconds | Completely ineffective | OpenVPN | ❌ <2 min |
| ❌ <2 min | ❌ <2 min | ❌ Minutes | Completely ineffective |
| NordVPN (various modes) | ❌ Mostly fails | ❌ Mostly fails | ⚠️ Occasional |
| ❌/⚠️ | Getting INFOCROSS From Inside Iran | The practical challenge: infocross.info is likely blocked in Iran (most foreign VPN sites are). The Telegram-bot distribution model solves this — Telegram is partially accessible during non-shutdown periods, and you can reach @infocross_bot directly. | Step-by-step for Iranian users |
| - Establish initial Telegram access via free tool (Psiphon or Lantern for initial setup only) | - Open @infocross_bot in Telegram | - Purchase a plan paying in USDT TRC-20 or TON — no Iranian bank card required | - Receive VLESS key immediately |
| - Install Hiddify: available on Google Play or GitHub releases. GitHub is often accessible even when Google Play is filtered. | - Add key → Connect → switch from temporary tool to VLESS Reality | Payment without Iranian banking | USDT TRC-20 is the most accessible crypto in Iran. Exchangers (صرافی) that handle crypto are widely available in major cities. P2P options: Bybit P2P, LocalBitcoins equivalents in Iranian Telegram channels. For diaspora users sending money in: TON is easiest via Telegram's @wallet bot. |
Latency from Tehran/major Iranian cities to different regions
- Turkey (Istanbul): 40–60ms — lowest latency, recommend as primary
- Germany (Frankfurt): 70–90ms — good performance, stable routing
- Netherlands (Amsterdam): 80–100ms — acceptable, good CDN proximity
- US East: 180–220ms — only if specific US-geolocated content needed
Select Turkey or Germany servers in @infocross_bot for best daily-use performance from Iran.
Based on the January 2026 shutdown (72-hour near-blackout) and previous events, practical preparation
- Have Hiddify installed and your VLESS key stored offline before any shutdown begins
- Have backup keys (multi-device INFOCROSS plan gives multiple independent keys)
- Have secondary tools as fallback (Psiphon, Lantern) even if slower — better than nothing during partial service
- Satellite internet (Starlink via smuggled terminals) remains the only truly reliable option during complete shutdowns — no VPN substitutes for a different physical connection
✅ Bottom Line
VLESS Reality via @infocross_bot survives Iran's active probing on all three major operators. Best server: Turkey (Istanbul) for latency. Payment: USDT TRC-20 (no Iranian bank card). Install Hiddify from GitHub. During complete shutdowns: no VPN is reliable — prepare backup access methods.
How INFOCROSS fits this use case
INFOCROSS VPN combines Telegram payment flow, VLESS Reality key delivery, QR setup, dashboard access, partner API, and support in one product. That makes it useful for individual users, families, Telegram communities, and projects that need reseller automation.