TT-only: distinct external IPs whose sslh fork has both an inbound TCP/443 socket AND an outbound socket to TT's :4443. OpenVPN internal subnet (10.8/24) excluded. GeoIP/ISP from ip-api.com (free tier, HTTP). Polled every 30s.