The Great Firewall Report (GFW), an organization that monitors and reports on China’s censorship efforts, published a pair of reviews this week pointing to a crackdown on TLS encryption tools used to bypass the famous firewall, The Register reports.

The group’s last message opens with the note “Over 100 users reported that at least one of their TLS-based circumvention servers was blocked” since Oct.

GFW analyzes this event as follows: “Blocking is done by blocking a particular port on which bypass services are listening. All IP addresses can be blocked when a user replaces a blocked port with an unblocked port and continues to use circumvention tools.”

Interestingly, the domains used with these tools are not added to the DNS or SNI blacklists of the Great Firewall of China, and blocking appears to be automatic and dynamic.

“Based on the information gathered above, we suspect, without experimental measurements yet, that the blocking may be related to the TLS fingerprints of these rogue circumventions,” the organization said.