Documents Geedge's standard operating procedure for building a new app-detection signature: collect a target's server IPs and FQDNs, create IP-match and SNI-match (ssl.handshake.extensions_server_name) feature objects, combine them via OR logic into a named custom "application", then validate via session-log reports filtered on that application label.

Engineers built and deployed IP-list and SNI-wildcard signatures to block Cloudflare WARP (the 1.1.1.1 app), including wildcard SNI blocking of *.cloudflare.com. A CTO-level engineer (name redacted) personally flagged the SNI-based rule as likely to cause false positives against unrelated Cloudflare-fronted traffic, given Cloudflare's role as a major CDN.

TSG maintains a traffic-volume-ranked "Top SNI" / "Top Server IP" allowlist (Galaxy component, learned from live traffic, capped at top ~2000 SNIs / ~40000 server IPs per Nacos config) that is checked before a VPN/circumvention-tool deny policy (including a Psiphon3-specific policy) is enforced. Confirmed empirically: Psiphon3 client traffic whose destination SNI was in the Top SNI list passed through undenied, while traffic to the same client IPs with an SNI not yet in the list was blocked. A 2022-06 incident over-blocked TikTok/BBC/CNN/NYTimes because their SNIs were not yet in the learned allowlist at the time.

Multi-week TSG engineering investigation of iTOP VPN (requested by an Ethiopia deployment, cross-tested in a Myanmar environment) found blocking only takes effect for VPN sessions established AFTER a detection policy is pushed; a VPN already connected before the policy loads is never blocked or logged, regardless of signature type (SNI or server-IP).

Geedge's own engineer explicitly documented that FQDN+JA3-based blocking of Panda VPN at the M22 (Myanmar) site was incomplete ("阻断并不完全还是会有穿透的数据流") and that the surviving traffic showed no identifiable signature, forcing a fallback to static server-IP blocklisting (216 IPs extracted across free/VIP nodes, tested on Android/iOS/Windows).

For a domestic Fujian deployment, Geedge validated SNI-wildcard blocking (*.sohucs.com, *.sns.sohu.com) as technically effective against a specific Chinese social app ('Huyou'), but rejected it for production because the domain is shared with a third-party SDK platform and would cause false-positive blocking of unrelated services -- falling back to destination server-IP blocking, deployed inline via TCP RST injection.

TSG automatically generates recurring weekly "SNI Report of Overseas APP" and companion "Server IP and Location of Overseas APP" reports at what is almost certainly a China-national (not export-customer) scale — single weekly runs process from ~5.7 trillion to over 135 billion rows and up to ~775TB/week — breaking down QUIC.SNI/SSL.SNI/HTTP.Host traffic per named blocked-in-China platform (YouTube, Facebook, Google, Twitter, Instagram, Telegram, WhatsApp, Netflix, BBC, Viber, Line, Snapchat, Gmail, HBO, and more), down to individual CDN edge hostnames (e.g. specific scontent-*.fbcdn.net and rr*---sn-*.googlevideo.com nodes ranked by bytes). The report series recurs weekly from at least Feb 2023 through Mar 2024.