Multi-Layer Passive Assessment of National Internet Infrastructure: A Post-Transition Case Study of Syria

This paper presents a passive security assessment of Syria's internet infrastructure during the country's post-December 2024 political transition. Analysing seven autonomous systems (1,230,080 unique IPv4 addresses) across five data layers — BGP topology, DNS and certificate transparency, measurement infrastructure, traffic and censorship patterns, and internet-facing service exposure — we characterise the security posture and resilience of a national internet in the aftermath of regime change. Measurements were collected in March 2026, with a targeted refresh of BGP topology and traffic data in August 2026; as of that refresh Syria has 13 registered autonomous systems, of which nine announce prefixes. Using exclusively public measurement data, we identify 15 significant findings spanning physical infrastructure, routing architecture, cryptographic adoption, censorship persistence and vulnerability exposure. No packets were sent to Syrian infrastructure at any point. The study also reports methodological negative results, including a case in which querying a routing API per-ASN silently omits withdrawal messages and produces the opposite conclusion to the per-prefix query. Severity ratings are labelled preliminary and AI-assisted, and each finding carries an explicit validation status. Ethics. Findings were disclosed to every operator named here on 2026-08-05, with a window to 2026-09-20 before publication. Dataset note. The raw BGP capture and the per-announcement RPKI table named as release artifacts in the reproducibility appendix are in the dataset record's first version, re-distributed with the RIPE NCC's written permission of 2026-09-21 (RIPEstat Service Terms and Conditions, Article 3.3), alongside the derived series behind every figure quoted from them.