pig butchering / long-con investment scam
weeks-to-months of chat grooming → fake crypto exchange → drained wallet. evidence spans messaging apps, crypto wallets, and screenshots.
a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.
wraps the pig butchering — loss reconstruction preset — drop chat exports + crypto address screenshots → extract IOCs (wallets, domains, urls) → cross-platform correlate → draft loss report
guided steps
- evidence manifest generator
hash chat exports + screenshots so the timeline of provided evidence is fixed
- ioc extractor
pull crypto wallets, fake-exchange domains, shortlink URLs from the message bodies
suggested options · format: json · aggregate: true
- ioc deduplicator and normalizer
merge across whatsapp + telegram + email exports — the same wallet usually appears in all three
suggested options · lowercase: true
- multi-artifact correlator
surface IOCs that span more than one chat channel — those are the load-bearing addresses / domains
- ioc bulk validator & triage
score the wallet + domain set; high-severity items are the ones to subpoena exchanges over
- case report generator
draft a victim-loss report with the wallet trail + exchange-of-record assertions
suggested options · title: pig butchering — loss reconstruction
when you're done
export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.