Over the past few years, several governments worldwide have put in place Internet censorship programs. Due to the lack of publicly available information, as well as the inherent risks of performing active measurements, it is often hard for the research community to analyze censorship practices. Therefore, the leak of 600GB worth of logs from 7 Blue Coat SG-9000 proxies deployed by Syrian authorities to monitor, filter, and cache Internet traffic, at a country scale represents a unique opportunity to provide a detailed snapshot of a real-world censorship ecosystem. This paper presents the methodology and the results of a measurement-based analysis of the Blue Coat logs. Our study uncovers a relatively stealthy, yet quite targeted, censorship. Traffic is filtered in several ways: using IP addresses and domain names to block subnets or websites, and keywords or categories to target specific content. We show that keyword-based censorship (e.g., denying all requests containing the word 'proxy') produces some collateral damage as many requests are blocked even if they do not relate to sensitive content. We also find out that Instant Messaging is heavily censored, while filtering of social media is limited to specific pages. Finally, we show that Syrian users try to evade censorship by using web/socks proxies, Tor, VPNs, and BitTorrent. To the best of our knowledge, our work provides the first analytical look into Internet filtering in Syria.