A leak-site listing can look like proof, but in ransomware cases it is often only a pressure tactic until logs, artifacts, or victim confirmation close the gap.