Recently, Iran’s government has launched a sort of new censorship system that manipulates bandwidth as I will describe below.
When a user connects to a VPN server and does an Ookla speed test, the download speed is good, but the upload speed drops dramatically after a few seconds. But meanwhile, the VPN still keeps connected, and if the user starts another speed test right after the previous one (with the same VPN session), again the same thing would happen (upload speed is good at first but drops suddenly after a few seconds).
But when no VPN is on, the upload speed is good.
My question is what is the (of course, possible) mechanism behind this method? How do they detect that this stage is the “initial stage” of the uploading, since both kinds of connections (with and without VPN) are encrypted, and they reduce the bandwidth after that only for the second type of connection? And are there any methods to bypass it, I mean how can I do something so the system intercepts that my connection is always in its “initial state”?
Edit: I tested with a VPN with a domain behind a Cloudflare IP, so IP limitation could not be the case. Also, I've read this question, which did not help me. I have to add that I use v2ray VPN protocol that looks like a normal HTTPS, (or sometimes SSH) connection.
A note about the answer: The answer provided by Steffen Ullrich was helpful. Also, I noticed that the behavior I described only was happening to certain Cloudflare IPs, so by manually changing the domain IP to another Cloudflare IP that was not designated to Iran using this project + using websocket tunnel instead of v2ray, partly the problem of upload speed solved (though it may be a temporary solution) It seems that the censoring system manipulates the DNS requests in a way that the best IP for the domain behind a cloud is not returned.