drop pcap + tor consensus · detect vpn-over-tor patterns
flags vpn handshake inside tor tunnel · double-hop timing · dns leak signatures
heuristic screener · parses artifacts locally · no password cracking or live network · encrypted tor circuits limit visibility · not definitive proof