An internal research document systematically profiles the domain/IP infrastructure, WHOIS/registration data, and captured traffic characteristics of three remote-access/VPN tools (Sunlogin/向日葵, TeamViewer, and OpenVPN over both TCP and UDP) as raw material for building app-identification detection signatures, following the same intro / user-scale / traffic-feature-analysis / packet-capture-and-naming structure per app -- consistent with the methodology described for Geedge's AppSketch signature-extraction pipeline.

TSG's AppSketch app-detection engine accepts custom Lua scripts for new signatures, feeding a client/server-role heuristic (lower port = server) for UDP policy matching; a custom OpenVPN-detection Lua script failed to trigger Deny specifically because that role-inference logic misclassified the flow's client/server sides.

An internal, '内部资料 注意保密'-classified architecture-group ('架构组') research report systematically profiles many third-party OA (office-collaboration) software products, extracting per-product app-identification features -- port-usage ranking, URL patterns, favicons, trademarks, page titles, HTML structure -- plus dedicated Android/Windows client packet-capture sections and a documented packet-data storage scheme, consistent with app-ID signature engineering (AppSketch-adjacent work) rather than the market-research framing of the report's own title.

Beyond VPN/circumvention tools, the same exported signature format is used at large scale for ordinary consumer apps — e.g. a Bank of Communications ('jiaotongyinhang') signature matches four exact-match DNS query names (download1.bankcomm.com, mobile.95559.com.cn, mbank.95559.com.cn, monitor.bankcomm.cn), and other entries (huolala, qidiandushu, zhihu) use the newer dns.qname/ssl.sni/http.host/quic.sni four-vector pattern per app. A companion artifact (70707a230d7d) is a flat list of thousands of specific URL paths (not just domains) spanning news, e-commerce, government-adjacent, and international press sites — consistent with the fqdn_category_list field seen in TSG's session-log schema, i.e. this is categorization/classification reference data, not solely a VPN blocklist.

Exported AppSketch/MAAT signature-object JSON shows named per-VPN detection rules combining multiple independent vectors: CyberGhost's WireGuard variant is matched by a hex UDP-payload pattern (04000000*), destination port 1337, and ip.proto=17 together (signature cyberghostvpn_wireguard); Windscribe's OpenVPN control channel is matched by two offset-anchored hex byte patterns plus an exact 86-byte payload length (windscribevpn_openvpn_payload); and ExpressVPN is matched independently via a literal JA3 hash (ssl.analysis.ja3), FQDN strings (expressapisv2.com, www.expressvpn.works), and a large enumerated IP list (700+ individual ip.dst entries observed before the 200KB text-extraction cutoff).

A dedicated AppSketch/MAAT signature object named 'Psiphon-Volunteer-IP' (signature_id 4054) blocklists specific IPv4/IPv6 CIDR ranges by ip.dst regardless of port (192.122.190.0/24, 2001:48a8:687f:1::/64, 141.219.0.0/16, and more), i.e. Geedge maintains infrastructure-level blocking of known Psiphon volunteer-hosted proxy server ranges rather than relying solely on app/protocol fingerprinting.

A signature object dated 2024-10-28 and named 'VPN servers in Russia' (fqdn variant signature_id 6217, IP variant 6216) blocklists specific FQDNs (api.tap2free.net, vpnlocal.app) and a companion IP-address object, showing Geedge curates geography-scoped VPN-infrastructure collections by country rather than only per-app-brand signatures — i.e. any server identified as VPN infrastructure hosted in a given country can be swept into a blocklist independent of which client app uses it.