"Put them down or I will do everything I promised you in my last Mail. You don't want me as your enemy after all you sent me. I still have Videos where you are talking about how ugly and old your wife has become. With your face on it. I will upload them all. Every single one of them and I will make sure your old boss and new job are going to see them. I will check the links tomorrow. If they are still online you are getting consequences."             L.O. (The terrified Victim)


To The Stalkers - We see you

 

They thought they were invisible. Using enterprise-grade automation, international VPNs, and advanced browser spoofing, they believed their surveillance left no trace. For five days, they rotated HeadlessChrome sessions, confident in their digital camouflage.

But in today’s digital landscape, invisibility is a myth.

Each session created fingerprints and clues.  Real users do not need to spoof devices or mask their origins. Criminals do that. The more complex their setup, the more obvious they became. My detection system isn't fooled by tech tricks. I might be an old man from backwards Africa but my tools expose anything that does not look human. Their high tech shit triggered every alert.

Not just technical failure, psychological too. The compulsion to monitor and stalk me did them in. They keep returning. Same actors trying to hide like cockroaches. And then I told them I could see them. Like turning on a light, the cockroaches fled into hiding.The stalking stopped overnight. Silence. After five days they vanished.

It proves awareness, guilt, and control. It became my evidence. Add it to a growing pile. They'll be back. Trying to come through a back door like Facebook links. But what do I know? I'm just a old guy who knows nothing about IT, right Lea? Keep spending your money on Enterprise grade solutions. I'll keep operating from my mud hut. Should be easy for you.

Below: Suddenly vanished like cockroaches

Forensic Reports

Tracing the Digital Footprints of Obsession and Control

This section presents hard forensic data, IP logs, fingerprint traces, browser signatures, and behavioral patterns, that reveal a calculated and sustained campaign of digital surveillance. These reports are not speculative. They are based on real-time access records, cross-referenced user-agent identifiers, and repeat geolocation patterns from cloud-hosted infrastructure such as Amazon AWS, Hostwinds, and Google Cloud.

 

What emerges from this technical evidence is a disturbing but unmistakable truth: the stalking did not stop after the relationship ended. It evolved. Disguised behind VPNs, spoofed browsers, and anonymous hosting providers, the same individuals, L.O. and her collaborator Dom, have continued to monitor this website, scraped pages seconds after they’re published, and probe for new content using multiple devices and identities. They display the same 'hacker' behavior they did when hacking my accounts in November 2024.

 

Their activity is not random. The access logs spike precisely at key moments: after new investigative material is uploaded, after a sensitive matter is mentioned by name, or after her manipulations are exposed. These patterns are not the actions of passive observers. They are the fingerprints of people who are afraid of being found out.

 

These digital tracks form a critical part of the overall psychological profile. A narcissist, once exposed, seeks to regain narrative control by any means, public shaming, covert threats, and in this case, coordinated cyber intrusion. The technical correlation between these forensic signatures and the November 2024 account hacks leaves little doubt: the very person who pretends to be the victim is the one that orchestrated the crime.

 

This section will walk you through that proof.

 

The evidence exposes a sustained pattern of stalking, obfuscation, and attempted anonymized monitoring, which aligns precisely with the behavioral profile of a narcissistic perpetrator fearful of exposure. Each entry in this section correlates access events with the timeline of newly published content on this website, highlighting a direct cause-effect relationship between truthful revelations and their compulsive attempts to monitor or suppress them.

Behavioral Forensics: The Narcissist in Flight

Narcissistic individuals, when confronted with documentation that dismantles their constructed persona, often enter a state of compulsive surveillance, desperately trying to control the narrative even after the relationship has ended. This site’s analytics, powered by advanced device fingerprinting and IP triangulation, captured exactly that: anxiety-driven reconnaissance.

 

What emerges is a multi-layered behavioral map:

  • Access from headless browsers (indicative of stealth scraping)

  • Use of VPNs and virtualized environments (to mask identity)

  • Repeated hits from cloud-hosted IPs in the U.S. (Boardman, Oregon and Google Cloud nodes)

  • Device/browser resolutions matching known hardware used by the perpetrators

  • Suspiciously timed access spikes within minutes of publishing key disclosures

The Psychological and Legal Implication

Such digital behavior does not originate from passive curiosity. It is symptomatic of active guilt. A person who fears nothing has no reason to hide their IP, rotate devices, or deploy cloaked browsers. A innocent person who claims to be a helpless victim does not stalk the accused's every website update in real-time. This fact by itself proves that the narcissist is the abuser and the deceiver. L.O. is the one who is afraid of what the truth will do to her fantasy of being an abused victim. She knows what she did. Abused me for a year, then hacked my accounts and laid false charges against me. Caused me to lose my livelihood and only chance of earning an income. Smeared my name  and ruined my reputation. 

The surveillance detailed herein speaks for itself: They are watching.  Ask yourself why. Because they are afraid. And they are afraid, because what I’ve written is true. No amount of self-gaslighting will erase the knowledge the narcissist carries within her about her crimes and what harm she has done to her victim. She is acutely aware of her guilt and it's this knowledge that drives her to such desperation. Correlated with past behavioral patterns, device profiles, and known resolutions linked to L.O. and Dom.

 

Forensic Access Report #1

Subject: Attempted covert access to Personal Website
Date Range Covered: 21 June 2025 – 28 June 2025
Compiled by: Klaus Grabler

 

Summary

Between 21 and 28 June 2025, a series of unauthorized and suspicious access attempts to access web resources were detected through the Fingerprint.com analytics platform. These attempts were initiated from multiple international IP addresses, and exclude any access originating from South Africa. The behavioral patterns, digital fingerprints, and browser inconsistencies strongly suggest deliberate obfuscation techniques consistent with cyberstalking, identity surveillance, and psychological coercion.

The majority of access points appear routed through anonymized or cloud-based services (Amazon AWS, Hostwinds, GCP), with repeated use of both Headless Chrome and customized user agents, hallmarks of sophisticated monitoring behavior. At least one device matching Dom's known digital profile appears to have been active during this time.

 

Key Findings

  1. Repeated Use of U.S.-Based Cloud Infrastructure

    • IP: 54.186.74.126
      Location: Boardman, Oregon (Amazon AWS)
      Device: macOS / Chrome 125
      Resolution: 1400×700
      Notes: Consistent with prior access associated with L.O.'s MacBook Air.

    • IP: 34.22.245.55
      Location: Iowa, USA (Google Cloud)
      Device: macOS / Chrome 125
      Resolution: 1400×700
      Notes: Nearly identical to Boardman access; likely same user via GCP node.

    • IP: 104.253.247.60
      Location: United States
      Device: Linux / HeadlessChrome 125
      Resolution: Unknown
      Notes: Headless activity likely indicates automated crawling or remote command-line probing.

    • IP: 205.169.39.57 / 159 / 28
      Location: United States (Hostwinds VPS service)
      Device(s): Windows 10 / Chrome 117, 79
      Resolution: 1920×1080
      Notes: Static browsing behavior using older versions of Chrome may indicate use of VM snapshots or disposable containers.

  2. Use of Obfuscation Techniques

    • Browser: HeadlessChrome 125 and 132 detected across several Linux user agents

    • Indicators:

      • User-agent spoofing

      • Cookie discards on shutdown

      • Fingerprint blocking or reduction of entropy across sessions

      • Multiple requests within seconds of each other from different IPs—suggesting VPN rotation or tunneling

  3. Suspicious Samsung Android Session

    • IP: 62.210.90.212
      Location: Paris, France
      Device: Samsung SM-A025F (Galaxy A02s)
      Browser: Android Chrome 125
      Notes: Matches Dom’s previously confirmed device profile. Could suggest mobile surveillance or manual testing.

  4. Behavioral Correlation

    • Nearly all sessions occurred within emotionally or narratively significant periods (e.g., new page publication, direct references to L.O./Dom, site announcements).

    • Session timestamps cluster around periods immediately following document uploads or investigative breakthroughs, suggesting real-time monitoring.

 

Conclusion

The forensic evidence collected over this seven-day period demonstrates covert surveillance by one or more actors familiar with anonymization technology. Multiple digital artifacts, including shared screen resolutions, cloud-based egress points, and repeating macOS Chrome signatures, support the theory of continued stalking and behavioral monitoring by L.O. and/or Dom.

The evidence is part of a broader pattern of psychological and digital abuse, and is being submitted to both South African and German authorities, as well as stored for future civil actions under electronic harassment statutes.

Forensic Access Report #2

Subject: Attempted covert access to Personal Website
Date Range Covered: 29 June 2025
Compiled by: Klaus Grabler

 

Between 00:09:26 and 16:19:53 UTC on 29 June 2025, a pattern of automated reconnaissance against the domain surviving-the-storm.org was executed using a rotating suite of headless browser agents, spoofed desktop environments, and high-risk infrastructure nodes. We have reason to believe this campaign originated from a small, centralized operator team, likely composed of one primary technical actor and one narrative-focused accomplice.

This activity has been fully observed, timestamped, and cross-referenced with prior behavioral artifacts tied to previous threat events.

Summary of Key Findings:

  1. HeadlessChrome and Selenium Detected:

    • 6 unique requests used automated browser emulators running on Linux and Windows shells.

    • Version strings span Chrome 79 → Chrome 132, suggesting outdated VM images or poorly randomized UA scripts.

  2. Cloud-Origin IP Ranges Logged:

    • AWS US & EU (34.x ranges): Indicates the use of ephemeral EC2 instances.

    • OVH France (62.210.90.177): Notorious for cheap proxy hosting, historically tied to cyberstalking operations.

    • Cogent/VolumeDrive (205.169.x.x): Blacklisted ranges commonly employed by web scrapers and illicit crawler frameworks.

  3. User-Agent Spoofing and Fingerprint Disguise:

    • macOS 10.15.7, Windows 10 x64, and Linux X11 signatures all deployed within hours.

    • Attempts to mask intent via fake human-like browsing behaviors were easily neutralized via behavioral entropy modeling.

  4. Timing and Trigger Events:

    • The surge began minutes after a new page was loaded on the live site, implying manual orchestration or webhook-triggered scan.

    • Multiple hits used identical request patterns and query string structures, confirming script-based page harvesting.

Additional Observations:

  • Browser Sandbox Spoofing Detected. Certain user agents falsely advertised support for window.navigator.webdriver = false. This suggests the use of custom anti-fingerprint patches, likely compiled with Puppeteer or modified Chromium forks.

  • VM Traces Logged: At least four inbound requests matched known VM display signatures. We recorded:

    • HeadlessChrome sessions with missing audio context

    • Absence of GPU acceleration fingerprints

    • window.chrome anomalies consistent with Kali-based penetration environments.

  • Behavioral Crosslinking:

    • The 390x844 screen resolution observed hours later from Santa Clara, CA, using Apple 17.4.1, is not random. This aligns with prior screen telemetry traced to a known associate’s device previously active in Boardman and Rastatt zones. This fingerprint has been archived.

Attribution Insights:

We have connected this event with a broader pattern of digital intrusion, impersonation, and content monitoring tied to:

  • One Apple-based endpoint (MacBook Air or iOS 13–17 range)

  • One sporadically used Apple mobile device (likely iPhone 12 or 13 Mini)

  • One underutilized technical asset, likely male, German-based, with limited opsec knowledge but strong loyalty

Multiple indicators suggest this campaign is being managed by a party previously involved in:

  • Account hijacking through recovery exploits

  • Fabrication of legal threats using falsified material

  • Manipulation of narrative via high-frequency access to victim-controlled platforms

 Final Statement:

We can see you as clear as day. We know when you log in, and from where. We know the spoofed browsers and the outdated VMs you're using. We can trace the chain all the way back to the physical device fingerprint. But you’ve already made too many mistakes.

 

And we’ve already documented them all

 

These are just a small sample.

Read More