Consider that an attacker could find a number of websites hosted on EC2 us-east-1, and build statistics across not only all those websites from a single browser

Consider that an attacker could find a number of websites hosted on EC2 us-east-1, and build statistics across not only all those websites from a single browser, but also from multiple attacked users with similar average RTTs to us-east-1. Deviations from the mean across similar users would be the flags. And with a phishing campaign, you don't need to be accurate all the time.