drop gnunet node data · parse peerstore + configs
flags peer count anomalies · namespace publishes · transport overrides · cadet/gns/fs activity
heuristic screener · parses gnunet config and peerstore locally · no password cracking or live network · not definitive proof