drop browser history + screenshots · detect known marketplace URL patterns + screenshots
flags onion URLs · known marketplace names · vendor panel paths · btc/xmr payment refs · screenshot filenames
heuristic parsing only · URL/title pattern matching against known marketplace indicators · no password cracking or live network · not definitive proof