Currently, there is no complete firmware available online, nor has any independent technical team released comprehensive test results. The source of the screenshots and the actual deployment scope still need to be verified. The screenshots show that the relevant identification files were updated consecutively on July 1st, 3rd, 4th, and 8th, with two versions appearing on the 8th alone. Some file descriptions mention characteristics such as frequent changes in network addresses, concentrated regional traffic, and abnormal transmission patterns.
The recognition system library is continuously updated.
Mr. Sun Qin, who works in network technology, told our station that this type of technology is different from traditional website blocking. In the past, monitoring systems mainly blocked fixed domain names and server addresses, and users could still continue to connect after changing nodes. Traffic identification, on the other hand, observes the patterns left by the connections themselves. He said, "Some VPNs have frequently changing server addresses, some connections are particularly dense, and some data packets have relatively fixed sizes, all of which will attract their attention. Of course, the system may not know what content you have viewed, but it can determine that this traffic is very similar to a certain type of VPN, and then it will report it."
Sun Qin also stated that this does not mean the communication content has been cracked. The system may only be able to identify the connection type, but cannot directly see the web pages the user browses or the messages sent. Once a connection is flagged, the user may encounter speed limits, disconnections, or node blocking. Mr. Sun said, "For ordinary users, the most troublesome thing is that the system lists you first. Operators have real-name information, but whether they need to check the person later is another matter."
Renzihang disclosed a VPN traffic identification technology in its 2025 annual report patent list, titled "A VPN Traffic Identification Method and System Based on Multi-Model Fusion." Company documents also show that its business covers areas such as internet data centers, internet access services, cloud platforms, and domain name security.
The existing materials cannot prove that all the identification files in the screenshots were developed by Renzihang, nor can they confirm that all VPNs on the list have been stably identified in actual networks.
Users who use VPNs face the risk of being investigated.
In recent years, Chinese authorities have consistently cracked down on the use of VPNs to access overseas websites and have repeatedly warned that "circumventing the Great Firewall is illegal." Internet users still face warnings, fines, and investigations when using VPNs. Mr. Zhang, a network engineer from Jiangsu, pointed out in an interview that VPN identification databases need constant updates. Proxy software changes servers, protocols, and connection methods, requiring the identification system to adjust accordingly. He said, "It might be able to identify a website today, but it might become inaccurate after a software version is released. Therefore, the signature database is constantly being updated. It's essentially a constant battle between the two sides: one trying to evade identification, and the other trying to find new signatures."
Back in 2017, market research firm GlobalWebIndex estimated that there might be as many as 90 million VPN users in China. Mr. Zhang believes that ordinary internet users use VPNs for various reasons: some want to access information, some want to contact relatives and friends overseas, and others want to read news that is blocked in China. The technical system only categorizes traffic and may not distinguish the user's specific purpose. He said, "The system sees the connection characteristics; it doesn't ask why you're using it. Once it's marked as proxy traffic, the user usually doesn't know what might happen next."
Renzihang Network Technology Co., Ltd. was founded in May 2000 and is headquartered in Shenzhen. It was listed on the Shenzhen Stock Exchange's ChiNext board on April 25, 2012. The company's business involves network security and industrial internet security, with clients primarily consisting of government departments and telecommunications industry organizations.
The recognition range extends to computer terminals.
This station reported in April that a technical solution with the number CN121691088A was published in March. According to information from the China National Intellectual Property Administration, the patent was applied for by Fujian Zixun Information Technology Co., Ltd., and involves identifying whether a computer has a VPN enabled; it is currently in the substantive examination stage.
Mr. Zheng, a software engineer in Shenzhen, told our station at the time that this type of technology usually determines whether a computer is using a VPN by using a virtual network card, but some development software also generates virtual network cards, which may lead to misjudgment during normal use.
China's internet censorship is no longer limited to blocking websites, keywords, and server addresses. Traffic analysis, protocol identification, behavior classification, and terminal identification targeting encrypted connections are becoming new regulatory tools.
