The same M22-tagged VPN-finder plugin set implements active UDP probing to elicit and harvest server IP addresses from CyberGhost VPN's protocol behavior, and separately fingerprints Windscribe VPN via TLS certificate features — two distinct active-probing/fingerprinting techniques feeding the same central VPN-blocklist knowledge base, with an explicit configurable active-scan packet rate.

A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.

Raw TSG session_record export logs dated Nov 2024, tagged device_group 'YGN-MYTEL' (Yangon, Mytel), directly corroborate the leak's M22=Myanmar/Mytel/Yangon site-codename mapping with live production data: individual SSL sessions are classified by app as 'Hotspot Shield VPN' (destination get.adobe.com, likely a fronting/CDN endpoint) and allowed under a named whitelist rule 'whitelist_102024', geolocated client-side as Myanmar.Yangon.Yangon.

A censorship-circumvention survey presentation (English-language, apparently used for internal briefing/training on evasion techniques within this ecosystem) explicitly lists Lantern by name, alongside Snowflake, as a circumvention tool discoverable by censors via TLS ClientHello fingerprinting, citing NDSS 2019 "The Use of TLS in Censorship Circumvention," and separately catalogs active- probing techniques (port-scan plus protocol-specific probes) used to discover OpenVPN, probe-resistant proxies (obfs4/shadowsocks/OSSH/MTProto), and traditional VPN servers.

Under the internal "M22" project (deployment site "YGN-MYTEL" confirms this is Myanmar, at the Mytel carrier), Geedge runs a continuous, individually-tracked signature-extraction pipeline against named commercial VPN apps (Super Unlimited VPN, NotVPN, Avira Phantom, Bitdefender VPN, Thunder VPN, Panda VPN, Mouse VPN, HaloVPN, GoFly VPN, Kiwi/Kuto/Greennet/Gulf Super/Hatunnel+ VPN, and a customer-provided list of 141 more): active probing of app refresh/connect behavior (including automated UI-driving scripts) extracts server IP/FQDN lists, separately for free vs. paid tiers and Android vs. iOS, which are then loaded as blocklist objects and validated against a false-positive ("CT"/穿透) test pass in a separate demo environment before deployment.

Geedge runs an ongoing, systematically-numbered VPN/app fingerprinting program for the M22 (Myanmar) deployment — a tracked "M22-VPN List" with 188+ sequentially numbered entries, and a separate non-VPN app catalog past entry 550 — with weekly-cadence re-testing (e.g. Quark VPN patches issued repeatedly through late 2024 as the target app's own infrastructure changed).

Sustained, systematic feature-extraction campaign against ~20+ named commercial VPN apps (Secure VPN, VPN Turkey-series regional apps, Cloudbric, Thunder VPN, Quark VPN, TowerVPN, SymlexVPN, Tenta, tigerVPN, TLS Tunnel, Tomato VPN, VPNlat, VPNMonster, VPNPro, WhiteHatVPN, WolfVPN, and an ISAKMP/IKE-based and an OpenVPN-based app) for the Myanmar (M22) deployment, 2024. Methodology: reverse-engineer app API via Fiddler/mitm to enumerate server IP/FQDN lists where possible; fall back to Wireshark protocol-signature ID (e.g. recognizing raw ISAKMP port 500 or OpenVPN ports 1194/80) when APIs are unavailable; automated 'dial testing' (自动化拨测) continuously discovers new server IPs; ongoing re-verification explicitly tracks 'CT' (circumvention/breakthrough) to catch when a blocked app resumes working and needs a fingerprint update.