TSG's galaxy-job scheduler runs a 'Web Sketch' domain-probing task (given a sharded mode explicitly to support large-scale parallel probing across servers) and a 'CN' knowledge-base sync pipeline (JIRA ticket prefix CN-, matching this corpus's CyberNarrator codename) that supports encrypting sensitive knowledge-base files and periodically updates a dark-web-indicator table (ioc_darkweb) -- evidence that CyberNarrator's blocklist/knowledge-base pipeline includes an active domain-probing component and a dark-web IOC feed, beyond the previously-documented Psiphon3 IP-harvesting and Pakistan subscriber-correlation components.

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.

MESA Lab group-meeting notes record parallel R&D on a whitelist-filtering module and a project to fingerprint cloud-hosted circumvention/proxy infrastructure at the IP-block (not single-IP) level, explicitly modeled on 2017/2019 academic 'Bulletproof-hosting IP block' research; the notes also mention local packet captures that found Psiphon IPs, the domain types/ratios Psiphon uses, and active-probing behavior with candidate detection countermeasures.

Three harvested datasets catalog full server-fleet inventories for multiple commercial VPN/proxy brands -- WaselPro/BVPN/SmokeTunnel/iWasel/BackboneVPN (with per-node CA certificate, IPsec PSK, and SSH private key captured), VyprVPN/GoldenFrog (per-location hostname/IP/coordinates), and tap2free (per-node IP with PRO/FREE tier flags) -- i.e. Geedge enumerates and archives entire commercial VPN provider bootstrap/config responses, not just individually observed connections.

A MAAT/AppSketch signature literally named "Psiphon-Server-IP" blocks by destination IP against a list of 1,300+ IPs (the extracted text is truncated at ~200KB so the true list is likely larger, consistent with the taxonomy's cybernarrator/vpn-thwarting note of ~70-73K harvested Psiphon IPs), directly corroborating that the CyberNarrator/vpn-thwarting Psiphon3 IP-harvesting pipeline feeds its output straight into a production MAAT/AppSketch blocking signature.

cyber-narrator/cn-web (1183 commits) is CyberNarrator's Java Spring admin web application ("cn-admin", package net.geedge), containing a "galaxy" module (GalaxyProxyController/GalaxyResolveController) used to proxy/resolve queries, a BI-style "panel" visualization subsystem, and license-gated access control (LicenseInterceptor/LicenseService) — indicating each CyberNarrator deployment is licensed per-site/customer and depends on a "galaxy" service also seen backing other MESA web tools.

'fj-transform-api' (CyberNarrator, ticket prefix CN-) implements CallingStationID-to-IP correlation via ClickHouse (CN-927), resolving monitored network sessions to a RADIUS Calling-Station-ID (subscriber phone number) -- direct source-level confirmation of the subscriber-identity correlation capability described in the leak's CyberNarrator sales materials.