drop cellular radio scan + lac/cellid log · detect imsi catcher signatures · runs locally
flags silent handoffs · 2g-only attractor cells · lac jumps · identical cgi divergent signal · encryption downgrade hints
heuristic indicators only — not definitive stingray/imsi-catcher attribution · corroborate with lawful intercept records