drop tor hidden service callback log · parse session ids + user-agent + timing · runs locally
drop tor hidden service callback log · local only
heuristic screener · vendor schema varies · not definitive proof