Inside the Geedge Networks leak

In September 2025, the internal files of Chinese DPI company Geedge Networks were leaked to the public. We are analyzing their code to find out exactly how its systems watch and block Internet access — and where they are switched on.

What happened

Geedge Networks was founded in 2018 by researchers with ties to MESA, a lab at the Chinese Academy of Sciences that specializes in large-scale network traffic analysis. Its flagship product is the Tiangou Secure Gateway (TSG): a full-stack censorship platform that inspects Internet traffic, identifies what people are doing, and blocks what a government does not want them to reach.

In September 2025, more than 100,000 internal documents — source code, bug trackers, internal wikis, and years of developer history — were leaked to the public. Journalists and human rights organizations who received early access have documented how Geedge sells this technology to governments abroad, with deployments reported in Kazakhstan, Ethiopia, Pakistan, and Myanmar.

This is the first time the source code of a commercial censorship system has become public. Until now, almost everything researchers knew about systems like these was inferred from the outside, by sending traffic at them and watching what came back.

What we're doing

We are a group of Internet censorship researchers across five universities and the GFW Report. We read the leaked code, built the TSG firewall, and ran it in an isolated lab so we could study it directly rather than guessing at it from a distance.

That gives us something the field has never had: the ability to take a behavior we find in the source code, turn it into a fingerprint, and then check real censorship systems around the world to see which ones behave the same way. Our goal is to help the people who build circumvention tools understand precisely what they are up against.

What we've found so far

• China's Great Firewall is running parts of TSG. Geedge's systems are sold abroad, but we found the firewall itself carries fingerprints from the leaked code — in how it forges DNS responses and how it generates the packets it uses to cut connections off. The same code, or a close relative, appears to be part of China's national censorship system.
• TSG is built to hunt VPNs and circumvention tools. The leak contains detection signatures for Psiphon, Tor, ExpressVPN, NordVPN, Ultrasurf, WARP and dozens more. Blocking these tools is not a side effect of the product; it is a headline feature.
• Censorship is sold and supported like any other enterprise product. Internal tickets show government customers filing bug reports when a tool slips through, asking for one app to be blocked before another, and complaining when the censorship catches too much legitimate traffic. Myanmar alone accounts for hundreds of these tickets.