Hi, I'm sorry for interrupting the thread and really hope all those that are affected get their money back.In very first place I doubt he has the know-how to run on TLS 1.3 (which is the only encryption standard which can't be broken as of today), aside to this he probably used a VPN provider or a Socks 4/5 Proxy, in any case also if running on Tor + VPN/Socks Proxies, if the torrc isn't configured properly in order to use Entry and Exit Nodes which relies ONLY ON TLS 1.3 by whitelisting them and at same time black-listing malicious nodes (using both IP addresses and RegEx), he can be tracked down quite easily by reconstructing the Tor circuits he used and the Logs on them. Not to mention the use of Strict IPTables rules, in fact I doubt also he's able to write a proper IPTables rules file in order to drop malicious packets sent by malicious nodes to hook their clients.
That said, this number -> +389 77 646 409 (which is reported on the website) with high probabilities belongs to an online temporary number provider, thus it's not a real sim card. Anyway this is not a problem, also if he paid with crypto, transactions can be reconstructed through chain analysis techniques while if he paid with a "carded" credit card the process is even more simple because in this case, financial authorities will do the job themselves and track down this lamer's real identity (ah yes, I also doubt he used a Fake ID to be honest and it's trying to spread this information in order to try to save his ass).
We will do some OSINT on the company he mentioned in the screenshots posted by @Deepansh in order to understand under which jurisdiction this company has been incorporated: much probably is a UK-based company, if this is the case the Proof-of-Address to incorporate a company that it's requested by Companies House shouldn't be older then 60 days, in other words this is also another piece of the puzzle that will bring us to understand if the identity used it's real or fake, simply put because when buying Fake IDs on the darknet, they usually don't have such document updated "on time".
Last but not least, why should he care to refund people if he's using a Fake ID? (lol)
Continues...
The major reason why I replied is to ask if you can point me in the right direction(s) to learn all these things you're talking about. If there are courses or sites you'd recommend, I would really appreciate. Thank you.
