drop vpn provider subpoena response (where applicable) · parse logged data · runs locally
drop vpn provider subpoena response (where applicable) · local only
heuristic screener · vendor schema varies · not definitive proof