Voidly Atlas already tells you HOW a country blocks — DNS poisoning, TCP RST injection, TLS handshake interference, blockpage redirects. Until today it didn't tell you WHICH VENDOR is doing the blocking. The DPI Fingerprint Library v1 closes that gap: a curated, public, citation-backed library of 14 deep-packet-inspection devices — both state-deployed (Russia TSPU, China GFW, Iran ARIA DPI, Belarus Beltelecom, Turkey BTK, Myanmar Junta, Pakistan PTA) and commercial appliances (FortiGate, Sangfor, Netsweeper, Blue Coat, Smartfilter, Cisco WSA, Palo Alto) — heuristically matched against every row in the 85K-evidence database.

Why this matters

Naming the vendor changes the story. “Iran blocks Signal” is a political claim; “Iran's ARIA DPI redirects Signal SNI traffic to 10.10.34.34” is an investigative one. Citizen Lab's Planet Netsweeper (2018), Behind Blue Coat (2011), and the IMC 2022 TSPU paper showed that vendor attribution is the hinge that turns “censorship happened” into “who built it, who sold it, who is liable.”

Methodology

Each fingerprint is a hand-curated rule with up to four components:

• country_prior — a HARD GATE: the countries where the vendor is publicly documented as deployed. Outside that set, the fingerprint is never considered. This prevents obvious false positives (Russia TSPU was matching Vietnam in v0 because of a regex hit on instagram.com).
• signal_type_in — which evidence-row signal_type values are consistent with this vendor (e.g. tcp-reset for TSPU, dns-blocking + tcp-reset for the GFW).
• blocking_method_in — finer-grained tag.
• upstream_claim_regex — optional regex over the raw upstream_claim text. Where OONI preserves blockpage HTML or the URL of a known sinkhole (10.10.34.34 for Iran, peyvandha.ir, deny.netsweeper.*, Server: SF-IAM, FortiGuard Web Filter Violation), this component fires hardest.

The confidence score is a weighted sum (weights sum to 1.0) of the fired components. We emit at most one vendor match per row, choosing the highest score above the per-fingerprint confidence floor; ties go to the rule with the most specific signal (regex > blocking_method > country_prior).

Results

Backfilled across 85,549 evidence rows: 19,506 matches (22.8%) spread across 10 of 14 vendors. The other four (Sangfor, Cisco WSA, Palo Alto, Smartfilter) ship with regex-heavy fingerprints because the only honest way to identify them is the HTTP response header or blockpage HTML — OONI doesn't always capture that text, so the vendors are present in the library but rarely fire in the current evidence base.

Endpoints

• GET /v1/atlas/dpi-fingerprints — full library + match stats + honest caveats.
• GET /v1/atlas/dpi-fingerprints/{vendor_slug} — paginated evidence rows that matched a vendor, plus the vendor definition and per-country histogram. Supports ?country=&limit=&offset=&min_confidence=.
• GET /v1/atlas/dpi-distribution — per-country vendor distribution, optionally filtered by country or vendor.

Honest caveats

• Heuristic matching, not ML — false positives possible.
• Public fingerprints lag vendor product updates (FortiGate redesigned its blockpage HTML in 2023; pre-2023 evidence may still match).
• State DPI configurations rotate (Iranian/Chinese governments update keyword + SNI lists daily); matches age out.
• An evidence row matching a vendor does NOT mean that vendor performed the block — only that the observed signal is consistent with that vendor's known behaviour pattern.
• Multi-vendor environments are common: a country may run Sangfor at ISP-A and FortiGate at ISP-B — we match at evidence- row granularity, not country granularity.
• Some vendors share blockpage templates with white-label clones; Sangfor + a few Sangfor OEMs are difficult to disambiguate.
• We do NOT identify the operator (government vs ISP vs corporate filter); the vendor match is the device family only.