Political Situation Unsettled, Parade Approaches, China’s Internet Experiences Large-Scale Anomaly

At dawn on August 20, China’s cyberspace experienced a large-scale disruption: outbound port 443 was blocked. (Web screenshot)

[People News] With Beijing’s September 3rd military parade approaching and the political climate inside Zhongnanhai increasingly turbulent, the CCP has been intensifying its “stability maintenance.” In the early morning of August 20, China’s internet suddenly experienced a major disruption. Technicians pointed out that this move was related to upcoming political events, akin to a military drill: “The goal is to enable rapid internet shutdown during sensitive moments, preventing citizens from organising.”

According to Dajiyuan, in the early morning of August 20, outbound port 443 traffic (HTTPS encrypted connections) was comprehensively blocked, affecting Apple, Tesla, Bing, and other international websites.

That night, complaints flooded social media platforms and WeChat groups inside and outside China: “websites won’t load,” “VPNs don’t work.” Users in Beijing, Shanghai, and other regions reported the same, with some posting screenshots of nearly twenty blocked IP addresses.

A foreign research institute’s Analysis Report released the same day confirmed that between 00:34–01:48 (UTC+8) on August 20, 2025, the Great Firewall (GFW) injected forged TCP RST+ACK packets into all TCP 443 connections, causing massive connectivity interruptions between China and the world.

The report stated: The injection targeted only port 443, not others such as 22, 80, or 8443. Both inbound and outbound traffic were affected. The triggering mechanism was asymmetric: inside-China SYN and SYN+ACK each triggered 3 RST+ACK injections; outside-China, only server-side SYN+ACK was triggered. Device fingerprints did not match existing GFW signatures, suggesting new equipment or misconfiguration. The disruption lasted about 74 minutes.

Dajiyuan reporters observed feedback: from 00:34, outbound 443 was blocked; by 01:30, both inbound and outbound were cut, and nearly all cross-border encrypted traffic stopped. By 01:38, some large services began to recover; by 01:50, many websites gradually returned. The incident lasted about one hour.

Network engineer: looks more like a stress test

Yang Kun (alias), a cybersecurity engineer in Hebei, told Dajiyuan he also detected the anomaly, but this wasn’t the first time: “There have already been several similar cases recently, usually around midnight. The block generally lasts about an hour. It looks more like a technical test than a full drill.”

He added, “This time was unusual. From the timing and routes, it looked like a stress test after a firewall upgrade—probing for weaknesses and patching them. About a month ago, there was another case, lasting 20 minutes around 1 a.m.”

Rapid shutdown during sensitive moments to prevent organising

Another engineer, Mr. Guo, told Dajiyuan, “Upgrading the firewall is no different from military exercises. They test it in virtual networks and LANs, and once a mass incident happens, they can activate it immediately. The goal is to achieve rapid disconnection during sensitive times to stop citizens from organising.”

He also revealed that in recent years, the firewall has not been managed solely by the “national team.” Some provinces are building their own “provincial firewalls” to restrict users locally: “Henan and Shandong are examples. After the pandemic, this trend became clearer. The national firewall controls the external internet, but provinces can now set their own rules and intercept data. It’s like adding a ‘wall within the wall.’”

In May this year, an international research report was jointly released by GFW. Reports, Stanford University and the University of Massachusetts Amherst confirmed Henan as the first province known to deploy such a “wall within the wall.” Since late 2023, Henan’s main internet gateways began operating a local filtering system that blocked over 4.2 million domains—including academic and government websites—far exceeding the scope of the national firewall.

Experts warn that this shows censorship power is devolving downward, giving local governments more control, which may fragment the internet environment even further across regions.

CCP signals digital wartime preparedness

A Beijing political observer noted that central spending on internet security engineering is massive—“even exceeding some of the CCP’s external propaganda budgets.” He said the timing of these tests, coinciding with upcoming political events, reveals the regime is preparing for “digital wartime readiness.”

Mainland experts caution that since port 443 is the backbone of global encrypted communications, repeated blockages would not only impact ordinary users but also disrupt cross-border business operations, scientific collaboration, and financial transactions. With the September 3rd parade looming, these tests resemble a “cyber defence drill,” showing that a tighter surveillance and control system has already taken shape. △