Geedge's M22 (Myanmar) team ran an active fingerprinting program specifically against "lanternVPN" in Aug 2024. They found the Android client's TLSv1 connections have fixed-position header fields (protocol version, payload length) usable as a static byte-pattern block signature, and that fake-SNI TLS 1.2/1.3 connections could only be blocked via destination-IP lists. They then built an automated pipeline (JA4 flow classification + domain/IP correlation + emulator-driven "new device" node discovery) that harvested 400-800+ new server IPs per week over the following month.

Raw TSG session_record export logs dated Nov 2024, tagged device_group 'YGN-MYTEL' (Yangon, Mytel), directly corroborate the leak's M22=Myanmar/Mytel/Yangon site-codename mapping with live production data: individual SSL sessions are classified by app as 'Hotspot Shield VPN' (destination get.adobe.com, likely a fronting/CDN endpoint) and allowed under a named whitelist rule 'whitelist_102024', geolocated client-side as Myanmar.Yangon.Yangon.

Geedge runs an ongoing, systematically-numbered VPN/app fingerprinting program for the M22 (Myanmar) deployment — a tracked "M22-VPN List" with 188+ sequentially numbered entries, and a separate non-VPN app catalog past entry 550 — with weekly-cadence re-testing (e.g. Quark VPN patches issued repeatedly through late 2024 as the target app's own infrastructure changed).

Sustained, systematic feature-extraction campaign against ~20+ named commercial VPN apps (Secure VPN, VPN Turkey-series regional apps, Cloudbric, Thunder VPN, Quark VPN, TowerVPN, SymlexVPN, Tenta, tigerVPN, TLS Tunnel, Tomato VPN, VPNlat, VPNMonster, VPNPro, WhiteHatVPN, WolfVPN, and an ISAKMP/IKE-based and an OpenVPN-based app) for the Myanmar (M22) deployment, 2024. Methodology: reverse-engineer app API via Fiddler/mitm to enumerate server IP/FQDN lists where possible; fall back to Wireshark protocol-signature ID (e.g. recognizing raw ISAKMP port 500 or OpenVPN ports 1194/80) when APIs are unavailable; automated 'dial testing' (自动化拨测) continuously discovers new server IPs; ongoing re-verification explicitly tracks 'CT' (circumvention/breakthrough) to catch when a blocked app resumes working and needs a fingerprint update.

Geedge's own engineer explicitly documented that FQDN+JA3-based blocking of Panda VPN at the M22 (Myanmar) site was incomplete ("阻断并不完全还是会有穿透的数据流") and that the surviving traffic showed no identifiable signature, forcing a fallback to static server-IP blocklisting (216 IPs extracted across free/VIP nodes, tested on Android/iOS/Windows).

M22 runs a large-scale automated pipeline against numerous commercial VPN apps: APK decompilation + HTTPS-proxy interception to extract servers/FQDNs, automated dial-testing at volume (one app: 17,554 dial-tests, 4,073 servers discovered, 94% 24-hour block rate), and OpenCV-based automated ad-dismissal to keep test automation running unattended.

Under the internal "M22" project (deployment site "YGN-MYTEL" confirms this is Myanmar, at the Mytel carrier), Geedge runs a continuous, individually-tracked signature-extraction pipeline against named commercial VPN apps (Super Unlimited VPN, NotVPN, Avira Phantom, Bitdefender VPN, Thunder VPN, Panda VPN, Mouse VPN, HaloVPN, GoFly VPN, Kiwi/Kuto/Greennet/Gulf Super/Hatunnel+ VPN, and a customer-provided list of 141 more): active probing of app refresh/connect behavior (including automated UI-driving scripts) extracts server IP/FQDN lists, separately for free vs. paid tiers and Android vs. iOS, which are then loaded as blocklist objects and validated against a false-positive ("CT"/穿透) test pass in a separate demo environment before deployment.