Tactics
FBI IC3 asks for wallets, hashes, amounts, times, phones, emails, domains, and IPs. Chainalysis-class desks follow the money. PhishDestroy-class desks map the site. We do both, then add a unique lure that logs the opener.
Each matter gets a one-time URL. The victim sends it only to the number or email that contacted them. When that person opens it, we log IP, ASN, city of the egress, timezone, and user-agent. A 1×1 pixel does the same in a message. We do not collect seeds or passwords.
NANPA rate center from the NPA-NXX. That is where the number was sold, not where the handset sits. The file says so, and tells the agency to ask the carrier for CSLI and WhatsApp for last-seen IP — not to geofence the city printed on the SIM.
MX, SPF, DMARC, disposable-domain flags, RDAP on the domain, and originating IPs from pasted headers. Webmail often hides the sender. The provider still has login IPs when legal process names the address.
DNS (Cloudflare DoH), RDAP, certificate-transparency names from crt.sh, TLS issuer, HTTP title, and IP geolocation of the host. Same method law-enforcement OSINT units use before a registrar letter.
Hits plotted by latitude and longitude of the network egress. This is not a Google Location History geofence and not a carrier area dump. Google stopped geofence warrants. A coffee-shop VPN is a city lie. The IP and time are still enough for the host or ISP to name a subscriber.
The report is shaped like the IC3 cryptocurrency fields plus subject identifiers. Copy it into ic3.gov. Agency matters also list the next preservation letters.
We do not invent a suspect. We name the exchange deposit, the Coinbase/Bitget-class withdrawal, the lure IP, and the phone rate center — the four places that actually produce a name and a city.
US investment theft on Form 4684 Section B; personal-use generally not deductible; TUCE fee listed for the preparer. Canadian capital-loss note. Not advice.