drop tox / qtox / onionshare / xmpp chat from ransom negotiation · parse threat actor messaging · runs locally
tox/qtox/xmpp export · local only
heuristic screener · vendor schema varies · not definitive proof