drop 3cx call log csv · parse internal + external calls
flags after-hours external calls · failed transfer chains · trunk abuse hints
heuristic screener · export format varies — not definitive proof