Blind relays remove content. They do not remove physics.
This page is the reason the site exists. If you read only one page, read this one: what survives encryption, what survives mimicry, and where the honest unknowns are.
The residual signal matrix
Every signal an observer can still collect against a threshold-blind relay network, and an honest rating of how well it holds up.
| Signal | Survives PRE? | Survives mimicry? | Collection point | Confidence |
|---|---|---|---|---|
| Timing & cadence | Yes | Partially: padding and jitter blur it | NetFlow, CDN edge logs | CONFIRMED |
| Byte-count distributions | Yes. Sizes are not encrypted away | Partially: size matching to a corpus | NetFlow, proxy logs | CONFIRMED |
| Relay churn rate | Yes | Yes; churn is structural, not shapable | DNS telemetry, passive DNS | CONFIRMED |
| TLS / JA4 fingerprints | Yes | Mostly: worker runtimes don't look like browsers | TLS termination, edge logs | CONFIRMED |
| DNS patterns of disposable workers | Yes | Yes; fresh hostnames must be resolved to be used | DNS resolvers, passive DNS | CONFIRMED |
| Session resumption patterns | Yes | Assessed: resumption cadence differs from products | NetFlow, TLS metadata | ASSESSED |
| Threshold-rebalancing events | Yes | Yes; a sudden replacement relay is a flare | DNS + TLS + CDN combined | ASSESSED |
| Payload content | No; that is the point of the model | - | - | LOST |
Hunting hypotheses
Phrased the way a detection engineer would implement them. Each is falsifiable, and the failures are listed, not hidden.
- H1. Process mismatch. Analytics-shaped traffic to worker-platform hostnames originating from processes that are not browsers. Collection: EDR network events joined to DNS. Confidence: CONFIRMED: strong signal, low false-positive rate in managed fleets.
- H2. Cadence regularity. Beacon-like check-in intervals that hold machine regularity under product-analytics payload shapes. Collection: NetFlow session timing. Confidence: ASSESSED: jitter degrades it; best used as a stacking feature, not a lone alert.
- H3. Churn clustering. Edge hostnames with short lifetimes whose appearance correlates with the disappearance of predecessors. Collection: passive DNS. Confidence: ASSESSED: disposable infrastructure is the model's strength; churn is the cost it cannot avoid.
- H4. Fingerprint mismatch. TLS client fingerprints consistent with cloud worker runtimes on sessions claiming to be product telemetry. Collection: JA4 at TLS-terminating infrastructure. Confidence: CONFIRMED: runtime fingerprints are hard to fake convincingly at scale.
- H5. Rebalance flare. A sudden new worker hostname appearing shortly after a related hostname goes silent: the threshold healing itself in public. Collection: DNS + TLS joined over time. Confidence: ASSESSED: rare, high-value when it fires.
Open questions
What the model cannot answer yet. Confidence discipline applies in both directions: no invented efficacy claims, for attack or defense.
- Mimicry fidelity at scale. Whether analytics-shaped traffic survives a well-resourced statistical baseline over months, not minutes, is untested. The model assumes mimicry is imperfect; how imperfect is an open question.
- Scale economics. Relay abundance is cheap at demonstration scale. Whether a large operation stays cheap, and quiet, under real churn pressure is unmeasured.
- Defense-in-depth interaction. How these residual signals compose with EDR posture, egress filtering, and identity signals in a mature environment has not been benchmarked.
Unknowns are tagged OPEN QUESTION wherever they appear on this site. That is a feature of the research, not a gap in it.