The 'fj-transform-api' service (ticket prefix CN-, matching the leak's internal 'CyberNarrator' codename) automatically pushes learned Psiphon3 server IPs as blocklist 'IP Object' entries into TSG's policy system on a recurring schedule, and separately manages 'KeywordsObject'/'KeywordsSource' entities pushed to the same TSG backend -- an automated circumvention-tool-IP-to-blocklist pipeline, adapted for TSG v24.02.

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.

MESA Lab group-meeting notes record parallel R&D on a whitelist-filtering module and a project to fingerprint cloud-hosted circumvention/proxy infrastructure at the IP-block (not single-IP) level, explicitly modeled on 2017/2019 academic 'Bulletproof-hosting IP block' research; the notes also mention local packet captures that found Psiphon IPs, the domain types/ratios Psiphon uses, and active-probing behavior with candidate detection countermeasures.

A MAAT/AppSketch signature literally named "Psiphon-Server-IP" blocks by destination IP against a list of 1,300+ IPs (the extracted text is truncated at ~200KB so the true list is likely larger, consistent with the taxonomy's cybernarrator/vpn-thwarting note of ~70-73K harvested Psiphon IPs), directly corroborating that the CyberNarrator/vpn-thwarting Psiphon3 IP-harvesting pipeline feeds its output straight into a production MAAT/AppSketch blocking signature.

cyber-narrator/cn-web (1183 commits) is CyberNarrator's Java Spring admin web application ("cn-admin", package net.geedge), containing a "galaxy" module (GalaxyProxyController/GalaxyResolveController) used to proxy/resolve queries, a BI-style "panel" visualization subsystem, and license-gated access control (LicenseInterceptor/LicenseService) — indicating each CyberNarrator deployment is licensed per-site/customer and depends on a "galaxy" service also seen backing other MESA web tools.

'fj-transform-api' (CyberNarrator, ticket prefix CN-) implements CallingStationID-to-IP correlation via ClickHouse (CN-927), resolving monitored network sessions to a RADIUS Calling-Station-ID (subscriber phone number) -- direct source-level confirmation of the subscriber-identity correlation capability described in the leak's CyberNarrator sales materials.

A GitLab-group repo literally named "cyber-narrator" (license-admin-api) implements a dedicated license-administration API for the CyberNarrator product using HASP hardware-dongle licensing (HaspUtil.java, HaspStatusEnum.java, C2V generation), confirming CyberNarrator is packaged/licensed as a distinct commercial component with its own entitlement-check service separate from core TSG licensing.