Internal site codename "E21" is confirmed as the Ethiopia TSG deployment — IGW node names in a traffic report match Ethiopian cities (Bahir Dar, Dire Dawa) alongside other coded node names (BOL, MWV), giving a reusable search key for the rest of the leak corpus.
BOL-IGW:链路1... Bahir Dar-IGW:链路1... MWV_IGW:链路1...链路2... Dire Dawa-IGW:链路1...
Defense implications
- 'E21' is a reusable search key for pulling every Ethiopia-specific record out of the rest of the leak.
Related findings
Ethiopia (E21) customer specifically tested Melon VPN and Ultrasurf against TSG; Ultrasurf's frequently-rotating IPs required an updated signature (successfully blocked after update), while Melon VPN's connection succeeded but was non-functional for other reasons (not attributed to TSG blocking).
Confirms the full licensed TSG component roster deployed at Ethiopia (E21): Firewall, Digital Observer, Email Retention, Statistics Policy, Proxy, Session Record, GTP Security, AppSketch, AppSketch Engine, AppSketch DB, WebSketch, WebSketch DB. Several license terms were extended to expire 2091-12-31, indicating a multi-decade commercial commitment.
A field-operations runbook, "子卡槽位更换操作流程" (card-slot swap procedure), documents live maintenance work at the "Shashamane-IGW" site — one of the Ethiopian international-gateway sites named in the E21 site-codename mapping — upgrading an 8x10G link to 1x100G on device "9000-SMBIO-P01R01-1", including commands to force optical channels to bypass mode, physically relocate an optical port card, and switch the link back from bypass to inline mode, confirming the deployment operates in a passive/bypass-capable inline architecture.
Side-by-side internal performance comparison across Xinjiang (China Mobile carrier deployment, hostname cmcc-xj-server1-sapp-244), Fujian (domestic), and Ethiopia (E21) explicitly references the same 'app_sketch_maat' diagnostic log format at all three sites, confirming the identical AppSketch app-fingerprinting stack is used for domestic Xinjiang surveillance and for the exported Ethiopia deployment.
Direct dated evidence (July 2023) that the Ethiopia (E21) customer actively toggles application-level blocking as a live policy lever: lifting the block on YouTube plus four other apps caused a documented traffic surge and device alerts at the BOL-IGW site.
The 'E21' site code in Geedge's internal Jira maps to an Ethiopia deployment sold/serviced through CEIEC (中国电子进出口, a Chinese state-owned defense electronics company) as an intermediary — Geedge explicitly white-labels delivery documentation with an OEM template before it reaches CEIEC, and CEIEC's Ethiopia office director is named as directly relaying the customer's blocking requirements.