Your Hosting Provider Is the New Censor: VPN Enforcement Moves to the Landlord
On 4 August 2026, more than twenty VPN services failed simultaneously in Russia. What was blocked was not a protocol and not an app: IP addresses and entire subnets of hosting providers went onto the blacklists. In parallel, a scheme is under discussion in which the hosting provider itself must answer for whatever runs on each of its addresses. This is not another filtering upgrade — it moves the point of enforcement from the wire to the lease.
What happened on 4 August
More than twenty popular VPN services stopped working for Russian users at the same time. Amnezia, Paper VPN, VPN Legend and GaMMa VPN were among those named. Neither protocols nor applications were targeted: the blacklists took IP addresses and entire subnets of major hosting providers whose racks held servers belonging to many services at once. Leonid Volkov called it the largest attack on circumvention tools on record. Roskomnadzor did not comment.
What is being proposed
Alongside the blocking wave, a scheme is under discussion that changes the mechanics of enforcement itself. The Center for Monitoring and Management of the Public Communication Network keeps an exception list — addresses that are never blocked: corporate VPNs and companies technological channels. Instead of a static list, continuous monitoring is proposed.
- If VPN infrastructure is detected on an allowlisted address within a week, the hosting provider receives a request — and 24 hours to answer.
- If it cannot confirm a legitimate technological purpose, the address is removed from the exception list and loses its protection from blocking.
- The number of accepted ways to verify a client identity drops from ten to three: the state ID system, biometrics, or a passport.
- A fully identified client would first be asked to fix the violation. A client known only by a phone number or a bank card can be cut off within 30 minutes.
As of July 2026, the hosting provider registry held 584 companies; the registry itself has existed since February 2024. The industry warns about false positives: IPv4 addresses change owners regularly, and a dirty history travels with the address to its next tenant.
Why this matters more than another protocol block
Until now the fight happened on the wire: filtering systems tried to recognise VPN traffic by the shape of its packets, and services answered with obfuscation. That is an arms race the defending side can play. The new scheme moves the point of enforcement from the wire to the landlord — from traffic to the lease agreement.
The difference is fundamental. Deep packet inspection is expensive, error-prone, and permanently one step behind new disguises. A hosting provider is a cheap lever: a specific legal entity in a registry, with a licence to lose. Once your host must vouch, under threat of sanction, for everything running on each of its IP addresses, the quality of your traffic disguise stops deciding anything. You are not being detected — you are being evicted. Encrypted headers and HTTPS mimicry are no defence against eviction.
A field observation: the decision is made per address
On 15 August we ran into this directly. One of our nodes stopped passing traffic entirely — from the outside it looked like a protocol block at the hosting level. On that same server we changed one thing, the IP address: same hardware, same provider, same protocol, same configuration. The node came back immediately.
The practical conclusion is simple: the restriction was bound to a specific address, not to the provider network and not to the type of traffic. That is exactly the picture the new scheme implies — the subject of blocking becomes the address, and whoever answers for it.
What actually helps under this logic
- Spreading across unrelated hosts and autonomous systems, not across countries. Three servers with one provider in three countries die from a single list entry. Geography is not diversity.
- The ability to re-address quickly. If a node can be given a new address in minutes instead of migrating for a week, eviction stops being a catastrophe.
- Automatic failover on the client side. A user should not learn about a block from an endless Connecting… spinner; the app must move them to a working node by itself.
- Protocol obfuscation still matters — but as defence against a different attack, traffic recognition. These are two separate layers, and both have to work.
How this looks at HamikVPN
We run our own servers across different sites and different providers — this is not resold access to a single host. Traffic runs over AmneziaWG with obfuscation. The app receives an ordered list of nodes and, when the primary one fails, moves the user to the next working one on its own.
An honest caveat: nobody can guarantee they will never be blocked, and anyone offering that guarantee is misleading you. But when the pressure point shifts to the landlord, the winner is not whoever has the cleverest protocol — it is whoever has addresses spread out and can move fast. That is how we build the service, and 15 August showed it works.