drop extortion messages + payment demands + platform reports · build ncii case package · runs locally
extortion messages · payment demand · platform report · local only
heuristic screener · vendor schema varies · not definitive proof