drop dns provider subpoena response · parse domain registration + activity · runs locally
drop dns provider subpoena response · local only
heuristic screener · vendor schema varies · not definitive proof