A January 2024 leadership-level "cyberspace mapping" (网络空间测绘) presentation by a MESA-affiliated researcher (name redacted) explicitly names Lantern VPN (蓝灯) and Psiphon as tracked circumvention-tool targets — citing their daily server-IP churn rates (8% and 3% respectively, sourced from Spur.us) as a measurement-difficulty case study — and describes a specific active-probing behavioral fingerprint for Lantern: Lantern VPN closes the connection within 2 seconds of receiving a payload of 7,000-17,000 bytes, but waits roughly 90 seconds before closing on any other payload length.

An internal MESA Lab presentation by a MESA Lab researcher (name/email redacted) describes 'CartoDNS', a global active/passive encrypted-DNS reconnaissance system that uses DNS-watermark injection across multi-region probing nodes to map DoT/DoH/DoQ resolver topology; as of the presentation it had discovered 80,000+ DoT, 20,000+ DoH and 4,000+ DoQ IPv4 resolvers (plus 1,100+ DoT and 500+ DoH over IPv6) and cataloged 500+ service providers with concrete IP ranges (Cloudflare, Google, Quad9, AdGuard, 360, Alibaba, Tencent, etc.), running continuously since December 2021.

An internal TSG functional-requirements spec ('加密协议JG') defines device support for identifying and blocking ECH, ESNI and QUIC traffic via per-connection SNI/region-matching tables (e.g. DF_QUIC_REGION), plus a companion 'FD报文全流程感知' feature that both passively monitors and actively injects synthetic verification traffic end-to-end through the network path to compute a live per-rule 'CT率' (breakthrough/penetration rate) — the system self-measures how often its own QUIC/ESNI/ECH blocks fail to take effect, and separately throttles logging/blocking detail for rule IDs receiving unusually high hit counts (DF_ATTACK_PROTECTION, 'targeted attack detection').

A WWW 2024 paper co-authored by MESA Lab's PI (MESA Lab PI, IIE-CAS (name redacted)) presents VPNChecker, a graph-based active-probing VPN-server detector modeling cross-port probe-response behavior; the paper states VPNChecker was deployed and evaluated inside a real ISP's network as a complement to existing detection engines, and documents concrete multi-port active-probing signatures for many commercial VPN/circumvention tools (e.g. Psiphon3: {22,53,443}, {22,443,554}, {22,53,443,554}).

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.

An internal MESA course slide deck, '网络空间测绘与安全应用 第四节：测绘的对抗-反测绘' ('Cyberspace Mapping and Security Applications, Section 4: Anti-Reconnaissance'), presented by a MESA Lab PI (name/email redacted), teaches a technique framework — probe-behavior identification/defense, hiding network-resource attributes and behavior, and network deception — for detecting and defeating outside researchers' active measurement of network infrastructure.

A June 2024 MESA/IIE-CAS master's thesis, '开放域名解析服务测绘关键技术研究' (Research on Key Measurement Techniques for Open DNS Resolution Service Reconnaissance), by a graduate student (name redacted), formally names Fang Binxing (方滨兴) — widely credited as the architect of China's Great Firewall — as the thesis advisor, directly tying him to MESA Lab's DNS-infrastructure reconnaissance research program.