Credits to bear / fear

Join those telegrams:
https://t.me/antiextchatt
https://t.me/antiextortioncha

Welcome readers, enjoy reading.

Section 1 - Spotting an extortionist
Section 2 - Gathering evidence
Section 3 - Forensics guidance
Section 4 - Submitting reports


——— 0x01 ————————————
Spotting an extortionist is generally easy, due to the fact you probably are already aware of who you’re looking for in terms of online monikers, handles and sectors of com. Your first question should always be: ‘how long have they been an extortionist for?’ This question gives insight to what trends they follow, what com they came from, what generation of com they fit under, how experienced they are with operational security.

There are thousands of ways to confirm who you’re looking for. Here is a detailed summary:

* The extortionist uses a certain genre of profile picture that could be of distorted edits, satanism, gore, goth, or fansigns.
* The extortionist is part of an online group or network, examples being “764” “8884” and “INCUR”.
* The extortionist reps a server using an OGU related vanity, reps a biolink profile, reps their buddies, reps an e-girl or reps song lyrics.
* The extortionist plays a game that is known for its popularity with e-girls, such as: roblox, vrchat, fortnite, valorant.
* The extortionist uses a common word followed by 2-3 numbers after, such as ‘sorry72’ or ‘sad825’ as their username, following a newer trend after the discord pomelo username rollout system that occurred in 2023. This can be exactly the same for telegram.

In many cases - more likely if you are a com vigilante, you will share a mutual server or group with the extortionist. The best way to start is by logging all their sent messages within that server, by filtering their account in the search bar. This works on both discord and telegram. Save any media containing images they may have taken themselves, as these can provide insight into their location, interests, hobbies, race, looks, style.

Assuming you have at least gathered a slither of information regarding their interests, try to join partnered servers you think they’d be in. Try to guess servers of games too. Dahood in roblox is very popular amongst extortionists as of 2025. If you manage to find any game related information out, log their messages from that server, see if you can dig out a username to their gaming related account(s).

Extortionists operate under a structured ideology, in the belief that if you joined recently, you are a ‘newgen’, and if you joined a long time ago, you would be considered an ‘oldgen’. A personal study done by myself over the past few years has proven that the newer people have a better understanding of operational security. The best way to catch a ‘newgen’ extortionist is to lay low. Any word they receive that they are being investigated, means they can delete traces from their digital footprint hardening an investigation.

This section covers the fundamentals of coming close within the extortionist’s paths, and a lot of the first part of your investigation will be primarily using your intuition and base knowledge. You need a good understanding of the way ‘com’ functions as a bigger network, to be able to know and explore the different paths an extortionist may have taken to get where they currently are.

Extortionists in 2025 are 90% influenced not by satanism - but by the idea of doing a crime until you get caught. They believe their operational security is so good that they will not get caught. They play this game like cat and mouse. The problem they encounter, is that everything they do is for superiority and inner fame. Meaning whatever they do and wherever they go, they have to make the world know, because that’s the way notoriety works in com.



——— 0x02 ————————————

Evidence gathering is the key to having justice served against the extortionist. If you make reports without evidence, your claims will be ignored.

In many cases, an extortionist will have extorted “content” aka fansigns, for groups they are apart of. I will list the main known com cults and organisations below.

764
657
676
646
101
502
505
717 / H3LL
832
737
210
747
111 / T111
333
8884
6996
7997
314
404
171
908
2992
O9A
CVLT
CVTT
INCUR
HARM NATION / HN
KASKAR / KSKR
LILITH / LTH
DEATH VALLEY / DV
MORIRE
SINIST3R
SR1
KNR
CUT NATION
SLITBUNNIES
LEAK SOCIETY
COURT
LEGION
MKY
NMK
MKU
NLM / NO LIVES MATTER
MMC / MANIC MURDER CULT
BOX
SUICIDEHILL

Every single cult has expectations once you are inside. This can be graffiti, arson, tire slashing, shooting, stabbing, extortion, sextortion, fansigning or editing.

This content is then published within a public channel, or spread around the com network as a form of trophy. Content features blood written names, or paper written names.

In some cases, the extortionist will create a ‘legacy’ channel featuring all the content they’ve gathered over time, to have on display in one big channel for everybody to see how much they’ve accomplished. This is the inner god and superiority complex within an extortionist.

A lot of the content can be found digging through public telegram channels of cult groups. Although sometimes an extortionist will set a piece of content as their display avatar on any one of their socials.

It only takes 1 piece of evidence to prove guilt, so gathering evidence is not a hard topic. Just a reminder that the more evidence gathered = the more time the extortionist can serve in prison. Each piece of content serves as a singular count of extortion, which can get up to 6 years in prison alone.



——— 0x03 ————————————

Forensics is also very much intuition-based as it is tool-based, so please don’t just rely on your intelligence tools. If you’re a law enforcement entity, I’m sure you’ll be capable of the full works of CSINT. But assuming you are a vigilante, let’s cover what you should do in OSINT.

Confirming leads is THE MOST important thing ever, I cannot stress enough to say the worst mistake you can make is not confirming a lead.

The risks of not confirming leads can cause a loss of money, time, resources, and even false imprisonment. You absolutely cannot throw an innocent man’s life down the toilet just because you were too lazy to confirm a lead.

I will not cover all the different routes to go down in OSINT, as there are many useful OSINT guides out there that can help your investigations.

Back to the first statement about using intuition, this means you will need to guess emails from partials, past aliases from past coms. If you do have a rough idea of what a partial could be, go the extra mile to confirm that it belongs to the extortionist. Leads must go round in a circle. You must be able to prove how e.g. a full name connects to an email address.

Make sure to write down everything you are thinking, no idea is too crazy and no process is too complex. You should be able to see how the dots join up once you note down the steps you took during your investigations. If something doesn’t feel or look quite right, the chances are it’s wrong.

I (Bear) learned from the best of the best, that includes ViLe.sh, CultKillers and other professional groups, and I am happy to share below.

Never investigate in a group of more than 3 people at a time, from experience - investigations get messy, confirmations get sloppy and in the end it amounts to one big detrace. 5 or so people have just wasted hours of their life and potential victim on the line just to go back to square one.

When investigating with a person, it’s 100% better to do it on a call. Clear communication makes for the best investigation. Everyone working on the extortionist needs to be on the same page.

If you are stuck on a lead where you think you have explored every possibility, you haven’t. Working in cre.ep, I’ve learned a funny thing about how ‘dead leads’ really work. We tend to investigate 1 lead at a time, and give up on the current lead claiming it’s dead. Think of the leads as a jigsaw puzzle, and the lead you’re current on sits in the top right corner of the puzzle. The lead before that sits in the bottom left corner. The lead is dead because you co not know how it can be used to find more information on the person. This indicates an investigation has been rushed, which I will move onto next.

DO NOT RUSH!!! Comparing my experience as an old timer in the new generation of pedohunting, the tools and resources have got better, AI is more advanced than ever and we have discovered so many ways in which we can boost our investigations. This comes at a cost however, because if the investigation gets rushed too hard, leads can be missed. One new lead can discover a whole new identity, changing the path of the investigation.

Vile.sh and CultKillers, the 2 oldest extortionist combatting groups took weeks maybe months on 1 investigation. Once an investigation was deemed completed, members of the groups would run through it at least 5 times (no exaggeration!) to ensure everything was correct.

My personal anecdotes put everything into perspective of the way investigations should be done compared to the ways they shouldn’t.

Justice being served will take a while, but the feeling of justice being served is one of the most relieving feelings known to man. It will sit with you forever.

Remember to take constant breaks if you feel burnt out during an open investigation. You cannot be tired or worn out whilst analysing data, this could cause missed leads, leaving gaps in an investigation ultimately failing to pinpoint the extortionist’s identity.

Please - a little advice from me, and I know some of you hunt extortionists for a reputation. If this is you, I present a warning, do not let your ego empower your thoughts. If you believe a (paste) investigation, is a ‘detrace’ or ‘fail’ as most would say, take it down instantly. The risks it poses could leave major impacts for real law enforcement investigations. You being a vigilante could be charged as an accomplice for the false leads posted.
Put your intuition above your ego, it could save your future. Address the failed investigation, make sure people know it’s failed. People will see you for your transparency and that is the respect you want. You want respect as someone helping law enforcement catch bad guys, not some wannabe moral based doxer. This isn’t purely directed at the people doing this for a reputation, this is also based at the genuine vigilantes that hunt for justice.



——— 0x04 ————————————

You are in charge of imprisoning the criminal, so take action as soon as you’re finished investigating.

For USA based criminals, see this article: https://www.fbi.gov/investigate/cyber

For international based criminals, see this: https://www.interpol.int/en/Crimes/Cybercrime

Every report sent along the interpol, NCA, IC3 tiplines are thoroughly checked. If you don’t remember to submit evidence, proof of claims, proper detailed information along with time stamps and dates matching the crimes, you will be prioritised low or ignored.

In case of an ongoing threat, immediately call the police. You won’t get in trouble for being a vigilante, so it’s okay to use your real number. Just be 100% certain you know the address of the extortionist, so they can catch them in the act.



——————————————————

To conclude this document, I’d like to share some links to some useful guides and resources.

Learn the common traits of a cyber criminal, to depict an extortionist from a regular individual: https://www.police1.com/corrections/articles/6-traits-that-lead-to-criminal-behavior-QKg2lpUaZbdKL1ot/

It is important to stay up to date with the latest cyber threats: https://thehackernews.com/search/label/Cyber%20Crime?m=1

Here is the most informative article regarding recent arrests against extorters I have found: https://www.wired.com/story/no-lives-matter-764-violence/

OPSEC training: https://www.dni.gov/files/NCSC/documents/training/OPSEC_Training_Schedule_2025.pdf