it wouldn’t surprise me if it was a tor service via bridge. the snowden docs showed that gchq uses tor to communicate with assets. a big part of the value of tor is that even if youre detected connecting to it, that doesnt prove youre doing anything in particular on it, only that you’re using the network.