drop hotspot portal auth log · detect credential stuffing bursts · runs locally
drop hotspot portal auth log · local only
heuristic screener · vendor schema varies · not definitive proof