In very first place I doubt he has the know-how to run on TLS 1.3 (which is the only encryption standard which can't be broken as of today), aside to this he probably used a VPN provider or a Socks 4/5 Proxy, in any case also if running on Tor + VPN/Socks Proxies, if the torrc isn't configured properly in order to use Entry and Exit Nodes which relies ONLY ON TLS 1.3 by whitelisting them and at same time black-listing malicious nodes (using both IP addresses and RegEx), he can be tracked down quite easily by reconstructing the Tor circuits he used and the Logs on them. Not to mention the use of Strict IPTables rules, in fact I doubt also he's able to write a proper IPTables rules file in order to drop malicious packets sent by malicious nodes to hook their clients.
That said, this number -> +389 77 646 409 (which is reported on the website) with high probabilities belongs to an online temporary number provider, thus it's not a real sim card. Anyway this is not a problem, also if he paid with crypto, transactions can be reconstructed through chain analysis techniques while if he paid with a "carded" credit card the process is even more simple because in this case, financial authorities will do the job themselves and track down this lamer's real identity (ah yes, I also doubt he used a Fake ID to be honest and it's trying to spread this information in order to try to save his ass).
We will do some OSINT on the company he mentioned in the screenshots posted by
@Deepansh in order to understand under which jurisdiction this company has been incorporated and most importantly if it really exists: in this case, much probably is a UK-based company or US-based company because of their low-cost of incorporation and on-boarding procedures which can be done entirely on-line, if this is the case, the Proof-of-Address to incorporate a company that it's requested by Companies House for UK-based companies and Company Register for US-based companies shouldn't be older then 60 days, in other words this is also another piece of the puzzle that will bring us to understand if the identity used it's real or fake, simply put because when buying Fake IDs on the darknet, they usually don't have such document updated "on time".
Last but not least, why should he care to refund people if he's using a Fake ID? (lol)
Continues...
