Names, handles, and identifying details in this story have been changed to protect everyone involved.

The first message the Millers showed me was short: “Enjoy your 7:30 walk with the dog.”

That was the line that told me this wasn’t random trolling. Somebody knew the family’s routine, and they wanted the family to know it.

By the time the Millers called our agency in early 2025, the harassment had been going on for weeks. An anonymous person, working through several burner accounts on Instagram, X, and encrypted messaging apps, had posted private family photos, published personal details, and sent threats that mentioned the family’s home. [One sentence on the demand, e.g. “They wanted $X, or the photos and address would go further.”]

The family had gone to the police, and the police were sympathetic, but their hands were tied. The accounts were anonymous, the platforms were slow to respond, and the trail crossed jurisdictions. The family had nothing to point at.

That’s usually where we come in.

Step one: Don’t touch anything

When a client is scared, the instinct is to act fast. The first thing we did was slow down.

Before any analysis, we preserved everything: screenshots, message links, metadata, and full email headers. We hashed each file and logged it so we could show exactly when we collected it and that nothing had changed. If this ever reached a courtroom, the evidence had to hold up.

We also assessed the danger. A threat that cites a daily routine means someone is watching, either online or in person. So before we asked who this was, we made sure the family had practical safety steps in place.

Then we set up a sandboxed research environment so we could observe the subject’s digital footprint without alerting them.

Step two: Follow the breadcrumbs

Anonymous people are rarely as anonymous as they think. The mask usually slips in small ways.

The main burner account had a distinctive username. We ran variations of it across more than 500 platforms, and two matches turned up on a regional auto-restoration forum and a local Discord server. That told us something about the person’s hobbies and where they lived.

Next we looked at the technical trail. A partial contact fragment tied to the account, cross-referenced against breach data, led to an old personal email address from a data leak years earlier. [Confirm how the fragment was lawfully obtained before publishing.] It wasn’t proof, but it was a name worth testing.

Then came the break that made the case feel real. One of the harasser’s photos showed the family’s house from the street. Enlarged, a parked car’s window held a faint reflection, and in it was a bumper sticker for a local custom auto shop. A person who posted on an auto forum, near a shop with that sticker, who had recently been on the family’s street.

Step three: From “probably” to “provable”

Our research pointed to one person: a former contractor who had worked on a neighboring property and had a known dispute with a subcontractor connected to the family.

I want to be clear about what we had at this point: a strong theory built on circumstantial clues. Circumstantial isn’t enough, so we looked for corroboration.

We observed from public areas, and his vehicle matched the one in the reflection. We compared the threatening messages with his public posts and found shared quirks: double spaces after periods, a distinctive misuse of one particular word, and the same odd capitalization. Writing style isn’t a fingerprint, and we never treated it as one, but it added weight.

Finally, with the client’s consent and legal guidance, the family sent the harasser a message with a link to a “formal legal notice.” The document sat on a server we controlled. When the sender opened it, the log showed a connection from the suspect’s general area, with no VPN masking it. An IP address won’t tell you which house someone is in, but together with everything else, the picture had stopped being theory.

Step four: Hand it to the people with the badge

We compiled a 45-page report: the chain-of-custody logs, diagrams showing how each clue connected to the next, the writing comparison, the access logs, and the surveillance photos. Then we gave it to law enforcement.

This is the part people often get wrong about private investigators. We don’t make arrests, and we don’t deliver verdicts. Our job was to give the police something they could act on, and they did. Detectives reviewed the evidence, obtained a search warrant, and examined the suspect’s devices, which confirmed the burner accounts were his.

He was arrested and charged with cyberstalking, felony extortion, and criminal harassment, and the family received a protective order. [Confirm case status and order type. Keep “charged” and “allegedly” until there is a conviction.]

What I want you to take from this

The Millers weren’t careless. They were ordinary people who posted ordinary things. Here is what made them easier to target, and how to avoid it:

• Strip location data from photos before you post them, and don’t live-post check-ins.
• Don’t reuse usernames across unrelated accounts. A repeated handle turned a hidden person into a findable one.
• Use separate, non-identifying emails and phone numbers for account recovery.
• Be careful with images of your home and routine. A reflection in a car window was enough.

And if you’re ever on the receiving end of something like this: don’t delete anything, don’t engage with the harasser, and report it to the police and the platforms. Then call someone who can help you build the case.

If you’re being harassed or threatened online and don’t know where to start, file a report with law enforcement. .