ACRIP Command Center

PRODUCTIONNeon main٠٧:٠٦ م

Canonical Run ID

ACRIP-MFI-20261101T181300Z-7A41C9E2

ناجح · PASS

What ran?TARGETED_EVENT

Verify whether Android FreeNet applications can enable unmetered Internet through zero-rating/tunneling and separate this from claims of accessing hidden Wi-Fi/hidden Internet.

Why this Topic?Android FreeNet / Zero-Rating Free-Riding — SNI/HTTP Tunneling & Hidden-Network Claim Separation

NEW_TOPIC

Confidenceغير مسجل

Research result: PASS

HOT_STARTغير مسجلDISCOVERYغير مسجلVALIDATIONغير مسجلDEDUPEغير مسجلCOMMITPASSREADBACKPASSCLOSUREPASS

Domain: Mobile Fraud Intelligence (MFI)
Run date: ٠١‏/١١‏/٢٠٢٦، ٣:٠٠ ص
Last verified: غير مسجل
Prior memory: محمّلة
Source status: CLOSED
Publication: DRAFT

NEW FreeNet/zero-rating topic: academic mechanism proof + current Android app ecosystem + privacy/sideloading/contractual controls + hidden-SSID claim separation; carrier-specific efficacy and community-file denominator kept gated.

EVIDENCE

الأدلة وما تثبته

9 سجل

Supports: Mechanism proof for carrier zero-rating free-riding and tunneling-based billing-classification abuse.
Does not prove: Any specific carrier is currently vulnerable; universal free Internet; present Jordan applicability.
Confidence: غير مسجل
Context: Academic network-security research

IFIP TMA 2024 / Universidad Autónoma de Madridفتح المصدرCY-T1 / Peer-Reviewed Academic

Supports: Tool identity: tunneling capability is distinct from underlying connectivity and carrier billing outcome.
Does not prove: Free data or billing bypass on any carrier.

CONTRADICTIONS

التناقضات والقيود

لا توجد تناقضات مسجلة لهذه الجولة.

UNCERTAINTY

الفجوات غير المحسومة

{"Notes":"Negative-space is not proof of regional absence.","Gap ID":"CY-GAP-MFI-7A41C9E2-01","Impact":"Blocks current local applicability/prevalence claims.","Status":"OPEN","Gap Type":"JORDAN_MENA_CARRIER_APPLICABILITY","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-MFI-7A41C9E2","Description":"No authorized carrier telemetry establishes which, if any, Jordan/MENA zero-rating configurations are currently susceptible.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101T181300Z-7A41C9E2","Required Evidence / Resolution":"Operator billing/DPI telemetry or authorized carrier/lab validation tied to specific zero-rated services."}
{"Notes":"Vendor claim ≠ operational proof.","Gap ID":"CY-GAP-MFI-7A41C9E2-02","Impact":"Blocks claims that advertised configurations currently deliver unmetered access.","Status":"OPEN","Gap Type":"VENDOR_OPERATIONAL_VALIDATION","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-MFI-7A41C9E2","Description":"KOFnet/vendor claims about specific active hosts/configurations were not independently validated against carrier billing records.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101T181300Z-7A41C9E2","Required Evidence / Resolution":"Independent authorized carrier billing/session evidence for named configurations."}

FOLLOW-UP

المتابعات غير المحسومة

4 مفتوحة

Priority: HIGH · Created: ٠٣‏/١١‏/٢٠٢٦، ١:١٣ م

Priority: MEDIUM · Created: ٠٣‏/١١‏/٢٠٢٦، ١:١٣ م

AUDIT TIMELINE

السجل الزمني الكامل

0 حدث

لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.

PERSISTENCE / READBACK

سلامة الالتزام والـReadback

Commit

ACRIP-COMMIT-MFI-7A41C9E2

COMMITTED · Readback PASS

SELF

SnapshotACRIP-SNAP-MFI-7A41C9E2

Integrity: PASS · غير مسجل

Evidence 77 · Hypotheses 49 · Runs 8

Payload fingerprint

98c6b0d2e9c456ecc320421759db9852ad381ef08bcd57e934d7fc117ed3dd1b

Canonical persistence

Commit: PASS · Readback: PASS · Closure: PASS

PASS — ACRIP-COMMIT-MFI-7A41C9E2 COMMITTED/READBACK_PASS; MFI SSOT 77 evidence / 49 hypotheses / 8 frozen runs; canonical 15 new memory objects unique; 10/10 evidence edges non-orphan; 4 gaps + Watch + Topic + Snapshot unique; Hot-Start v1.4 affected slices read back PASS at 327 memory / 187 evidence / 140 hypotheses / 128 active-open / 83 gaps / 14 watch / 28 topics registered / 27 active / 31 recent Runs. Shared Method Yield aggregate deliberately not overwritten; run methodology is persisted in the immutable Run Package. Protected Core unchanged.

Domain Store

العودة إلى سجل الجولات

تدقيق الجولة

الأدلة وما تثبته

Peer-reviewed research documents zero-rating free-riding using HTTP injection/tunneling and HTTP Injector, including a controlled dataset of fraudulent and legitimate traffic.

Official product documentation identifies HTTP Injector as a multi-protocol VPN/tunneling client supporting SSH, proxy, SSL/TLS, DNS tunnel, Shadowsocks and V2Ray with configuration import.

التناقضات والقيود

الفجوات غير المحسومة

المتابعات غير المحسومة

JORDAN_MENA_CARRIER_APPLICABILITY

VENDOR_OPERATIONAL_VALIDATION

CONFIG_ECOSYSTEM_VALIDITY

ABUSE_ENFORCEMENT_DENOMINATOR

السجل الزمني الكامل

سلامة الالتزام والـReadback

Current Google Play listing advertises SNI Bug Host Generation and Free Access Tools, confirming a real Android FreeNet-oriented app ecosystem.

Developer documentation describes carrier/country-filtered zero-rated SNI hosts, custom payloads and freenet VPN files, and acknowledges host volatility.

Official app-store description states SSH 2.0 use and customization of initial connection/injection text and SNI with configuration import/export.

FTC guidance explains that VPNs shift trust from the access network/ISP to the VPN provider and that some apps may share data or route traffic through third parties.

Google security guidance treats Internet-sideloaded apps as a higher-risk channel and describes Play Protect scanning/blocking for potentially harmful apps.

Carrier terms permit temporary or permanent suspension when service is used or attempted to be used fraudulently.

Official Android API documentation supports hidden SSID configuration while separately requiring WPA2/WPA3 passphrases/security parameters for protected networks.