drop near transaction · parse actions + signer + receiver · runs locally
parses function call · transfer · stake · add/delete key · delegate actions · flags large transfers and key changes
heuristic screener · parses artifacts locally · not definitive proof · no rpc