drop adguard home query log · parse per-client dns activity · runs locally
drop adguard home query log · local only
heuristic screener · vendor schema varies · not definitive proof