As the widespread internet shutdown in Iran continues, the market for selling VPNs and connection “configs” has surged. It is a chaotic and high-risk space where new methods are constantly being used to access the internet, while fraud and exploitation of users have also increased.
In this market, the price of “configs” – configuration files used to set up a connection – has reached between 500,000 to 1 million tomans per gigabyte (approximately £7 to £15). Reports from network traffic monitoring services show that less than 2 per cent of Iran’s population is currently connected to the internet. A large share of that group consists of users with so-called “white SIM cards”, which are privileged lines with fewer restrictions granted at the government’s discretion.
The services that have managed to keep users connected no longer function like traditional, single-route VPNs. Instead, they use multiple pathways and communication layers to transmit traffic, allowing data to be rerouted if one path is blocked. Over the past month, methods such as DNS tunnelling, slipstream techniques, HTTPS-based tunnelling, SSH connections, and encrypting DNS requests have gained increasing attention.
These methods are typically more effective for users with higher technical knowledge. However, what is currently sold as a “config” is usually designed for less experienced users. In this model, the provider pre-configures the setup, and the user simply receives a file or access key. Users must place significant trust in the provider, as the operator potentially has the ability to monitor their activity.
In recent weeks, due to increased demand, scams have also risen. Independent Persian has seen evidence of Telegram channels emerging that advertise “guaranteed VPNs” or “no-disruption configs”, but are in fact defrauding users. These scam operations typically fall into two categories: some take payment and deliver no service at all, while others cut off access before the purchased data is fully used.
From a security and anonymity perspective, the risk can begin at the very first step: the purchase process. If payment is made through official banking gateways using real identity details, users may already be exposing part of their personal and financial information to the seller. As some users within Iran report receiving text messages from the police warning them about accessing global internet – along with threats of SIM card disconnection and legal action – many people are now asking whether the authorities can identify VPN users.
