A censorship-circumvention survey presentation (English-language, apparently used for internal briefing/training on evasion techniques within this ecosystem) explicitly lists Lantern by name, alongside Snowflake, as a circumvention tool discoverable by censors via TLS ClientHello fingerprinting, citing NDSS 2019 "The Use of TLS in Censorship Circumvention," and separately catalogs active- probing techniques (port-scan plus protocol-specific probes) used to discover OpenVPN, probe-resistant proxies (obfs4/shadowsocks/OSSH/MTProto), and traditional VPN servers.

A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.

The same M22-tagged VPN-finder plugin set implements active UDP probing to elicit and harvest server IP addresses from CyberGhost VPN's protocol behavior, and separately fingerprints Windscribe VPN via TLS certificate features — two distinct active-probing/fingerprinting techniques feeding the same central VPN-blocklist knowledge base, with an explicit configurable active-scan packet rate.

A MESA Lab research note dissects the Tor Project's webtunnel pluggable transport (HTTPT-based) and reports a hands-on pcap analysis of 3 public webtunnel bridges: the observed TLS ClientHello/cipher-suite fingerprint and SNI matched an ordinary HTTPS connection to the bridge's cover domain, with no certificate visible in the captured handshake -- i.e. these deployments withstood the lab's basic passive TLS-layer fingerprinting attempt at the time of writing.

Session records carry client and server TLS fingerprints (ssl_ja3_hash, ssl_ja3s_hash) and equivalent DTLS fingerprints (dtls_ja3_fingerprint, dtls_ja3_hash) as first-class columns, and the same schema separately includes an SSH client/server fingerprint field (ssh_hassh) alongside ssh_cipher_alg/ssh_kex_alg/ssh_host_key_alg -- confirming JA3/JA3S-style and HASSH-style fingerprinting is computed and retained per session across TLS, DTLS, and SSH traffic, not just TLS.

An internal MESA Lab presentation by a MESA Lab researcher (name/email redacted) describes 'CartoDNS', a global active/passive encrypted-DNS reconnaissance system that uses DNS-watermark injection across multi-region probing nodes to map DoT/DoH/DoQ resolver topology; as of the presentation it had discovered 80,000+ DoT, 20,000+ DoH and 4,000+ DoQ IPv4 resolvers (plus 1,100+ DoT and 500+ DoH over IPv6) and cataloged 500+ service providers with concrete IP ranges (Cloudflare, Google, Quad9, AdGuard, 360, Alibaba, Tencent, etc.), running continuously since December 2021.

A June 2024 internal MESA Team survey ('针对审查系统的科学研究及探测技术调研报告') catalogs the academic censorship-measurement toolkit (OONI, Augur, Satellite, Quack/Hyperquack, GFWatch, GFWeb, middlebox weaponization studies, traceroute-based middlebox localization, device fingerprinting) and separately reviews circumvention-tool countermeasures, explicitly naming Lantern alongside Psiphon, Tor Meek and Signal as tools using uTLS-style TLS ClientHello mimicry and domain-fronting.