Traditional VPN and proxy protocols can both be detected, blocked, rate-limited, or disrupted by mainland network controls. Newer transport or obfuscation layers do not guarantee resistance; no client category is inherently undetectable, faster, lighter, or safer.

Clash-family proxy clients carry specific leak vectors distinct from VPNs: DNS leaks, IPv6 leaks, TUN-mode misconfiguration, rule-set bypass, and application-layer exclusions. Subscription URLs are equivalent to credentials and must be kept private; rotating a URL without evidence of a leak does not mitigate operator-level risk.

§4.2, §5.3, §5.5 defense

Subscription endpoints, node lists, and client configurations require ongoing updates to remain functional against evolving blocking, but accepting automatic configuration updates introduces supply-chain risk. Open-source code makes inspection possible but does not prove the binary matches the source, that an audit was performed, or that the server follows its stated policy.

§3.2, §4.6 deployment

Provider identity mismatches are a documented risk: one reviewed provider (SSONE) displays the domain hello-ssone.com but its registration links to flybit6202.com. Resolving such domain-identity mismatches before entering credentials or paying is flagged as a required evaluation step.

§5.2 deployment

An encrypted proxy (Shadowsocks, Trojan, VMess) protects only the client-to-server segment; traffic from the proxy server to a non-HTTPS destination may be readable on the onward path. Applications not covered by system-proxy, TUN, or routing rules connect directly, bypassing the tunnel entirely.

§1.1 defense

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Internal Geedge documents confirm active contracts to deploy GFW-derived censorship and surveillance infrastructure in Myanmar, Pakistan, Ethiopia, Kazakhstan, and at least one additional unidentified country under the Belt and Road framework, in addition to domestic deployments in Xinjiang, Jiangsu, and Fujian. The exported product (the Tiangou Secure Gateway / TSG line) is not a stripped-down export variant — leaked TSG documentation shows DPI, active-probing, ML classifiers, and granular per-region traffic control rules that mirror the domestic GFW capability set.

2025-geedge-mesa-leak §5, §6 dpiactive-probingml-classifiersni-blockingdns-poisoningfully-encrypted-detecttraffic-shape

InterSecLab's 76-page analysis of the Geedge/MESA leak (based on nine months of indexing and translating >100,000 documents) characterizes the Tiangou Secure Gateway (TSG) product line as a commercially deployable detection stack that combines deep packet inspection, real-time mobile subscriber monitoring, active probing, ML-based traffic classifiers, and granular per-region rule sets. TSG is not a research prototype — leaked documentation includes deployment timelines and client government interactions for Kazakhstan, Ethiopia, Pakistan, Myanmar, and one unnamed country, with censorship rules explicitly tailored to each region.

2025-interseclab-internet-coup §3–§5 (InterSecLab report) dpiactive-probingml-classifiersni-blockingip-blockingtraffic-shapefully-encrypted-detect

Censorship classifiers and traffic analysis attacks consistently exploit the initial seconds of a proxy connection, where packet-size, inter-arrival-time, and burst features are maximally discriminative. Cited work demonstrates that website fingerprinting classifiers trained solely on the first few seconds of Tor traffic achieve high accuracy, and real-world GFW detection of fully-encrypted protocols also targets early-connection bytes.

2025-pereira-extended §1 traffic-shapewebsite-fingerprintml-classifierdpifully-encrypted-detect

The GFW detects fully encrypted protocols using ad-hoc rules including the percentage of printable ASCII characters per packet (threshold: over 50%) and the observation that FEP entropy is considerably higher than normal encrypted TLS traffic. These rules are subject to frequent changes, making rigid FEP designs unable to adapt.

2025-wilson-extended §1 fully-encrypted-detectdpitraffic-shape

A September 2025 leak of 100,000+ internal documents from Geedge Networks—co-founded by Great Firewall architect Fang Binxing—confirms export of GFW-derived Tiangou Secure Gateway (TSG) to Myanmar, Pakistan, Ethiopia, and Kazakhstan, providing those governments with DPI-based filtering, throttling, VPN blocking, and internet-blackout capabilities previously unavailable to them. Pakistan's deployment replaced Sandvine's Web Monitoring System infrastructure after Sandvine was sanctioned and exited in 2023, with Geedge apparently utilizing existing Sandvine hardware. Kazakhstan was the first client, from 2018, and Geedge claims more than 40 global service providers as clients under the Belt and Road Initiative framework.

2025-wkrp-leak-geedge-networks body dpiip-blockingthrottlingtraffic-shape