drop i2p router dir · parse netDb + routerInfo + tunnels
flags hidden mode disabled · floodfill participation · unusual tunnel counts · netDb router hashes
heuristic screener · parses artifacts locally · no password cracking or live network · serialized netDb blobs are string-scanned only · not definitive proof