drop victim portal access log · parse login tokens + download attempts + ip hints · runs locally
drop victim portal access log · local only
heuristic screener · vendor schema varies · not definitive proof