[tor-relays] traffic pattern indicates MITM?