You are absolutely correct there, in that hypothetical scenario if they were to attempt to hide their traffic among normal instance activities.
To add a bit more detail to my previous answer, there were some prior discussions about this topic, citing some of the most popular instances of the entire Threadiverse having been targeted by their normal DDOS-like approach:
Assuming you know which instances are the ones they’re collecting data from. It could be any instance.
You are absolutely correct there, in that hypothetical scenario if they were to attempt to hide their traffic among normal instance activities.
To add a bit more detail to my previous answer, there were some prior discussions about this topic, citing some of the most popular instances of the entire Threadiverse having been targeted by their normal DDOS-like approach: