A user manual for a 'Malicious Service IPv6 Address Discovery and Assessment System' documents a sapp application-layer plugin (ipv6_domain.c) that extracts the HTTP Host header, TLS SNI, and DNS AAAA-record domain from live traffic and matches them against a malicious/blocked-domain list to resolve each hit's IPv6 address, alongside a separate active-probing pipeline (ZMapv6 + Entropy/IP-based address-space generation) used to discover IPv6 DNS resolvers and malicious-site IPv6 presence at internet scale.

Raw structured DNS event logs (dated 2021-08-23) captured from what appears to be a GFW-adjacent DNS monitoring/injection pipeline use a schema purpose-built for DNS response forgery ('CHEAT_TYPE', 'CHEAT_RCODE', 'CHEAT_STRATEGY', 'CHEAT_RR', 'INJECTED_PKT_FILE' fields) alongside per-query geolocation; sampled records show lookups for facebook.com and tiktokv.com originating from residential China Telecom/Unicom/Mobile subscriber IPs in Guangdong, Zhejiang, Anhui and other provinces, resolving against both domestic and foreign (8.8.8.8, OpenDNS) resolvers.

A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.

A 2023 MESA Lab monthly report (author and advisor names redacted) describes the 'TF' project's active-defense work: testing serial HTTP hijack/tamper and parallel DNS race-injection ('DNS抢答'), scaling active-defense compute boards from 3 to 5, converting two existing TSG units to active-defense mode, and rewriting active-defense flow control to no longer depend on sapp. NOTE: this content is nearly identical to the existing corpus finding 2026-084104-tf-active-defense (artifact 084104aa052e) -- likely the same underlying document ingested under two different artifact IDs; flagged for dedup review.

The same change document's post-deploy validation step explicitly checks that "spoofed packets and RST packets" are generated normally with no volume anomaly as routine production behavior, and the release separately adds a feature to retain full email body content (not just metadata) on business-user request, running on Kylin Linux Advanced Server V10.

An internal operations manual documents the end-to-end workflow for turning an official government blocking/monitoring request ("来函") into a technical rule on the sapp-based filtering system: analysts capture live traffic with Wireshark/Chrome to derive the exact keyword (DNS qname, TLS SNI, HTTP Host+path, or email From/To/Subject/Content/ attachment), choose one of four match modes (exact/prefix/suffix/ substring), and push it as either a "JC" (监测, monitoring) or "GK" (阻断/禁止, blocking) rule; DNS rules operate via DNS spoofing, HTTP/SSL rules via keyword/SNI matching, and email rules match headers or body/attachment content.

TSG's firewall 'Deny' security-policy action is confirmed implemented via three interchangeable mechanisms: TCP RST injection, forged HTTP 404 response-page injection, and DNS-redirect. Confirmed via commits to MESA_Platform/sapp and tsg/tsg-os-buildimage GitLab repos (git.mesalab.cn).