cyberstalking — quick-start

checklist

1. record the UTC timestamp of every incident — harassments, follows, impersonations — in a running log before memory degrades.
2. screenshot each incident with the account handle, post URL, platform, and UTC clock visible — before the poster deletes.
3. archive post URLs using a web archive service (archive.today, Wayback Machine) immediately — screenshots alone are fragile.
4. save the full URL of the stalker account — not just the handle; handles change, URLs often persist in platform records.
5. export or screenshot every direct message, email, or contact attempt from the stalker with timestamps visible.
6. inventory accounts the stalker has created that impersonate or reference the victim — note platform, handle, creation date if visible.
7. check whether real-world information about the victim has been posted (address, employer, family names, vehicle plate).
8. do not engage, block, or report yet until evidence is preserved — reporting can cause the actor to delete or go dark.
9. note any pattern of escalation: moved from public posts to DMs to phone calls to in-person proximity.
10. begin the primary tool path below — cyberstalking timeline correlator and account impersonation detector.

primary tools

1. 01ai chatbot multi-account correlation analyzercorrelate AI chatbot accounts, sessions, and devices across platforms · detect multi-account usage, shared devices, account switching · runs locally
2. 02multi-source entity resolverdrop forensic csvs · resolve names emails usernames ips across sources · probabilistic entity profiles · runs locally
3. 03investigation knowledge graph builderdrop forensic csv exports · extract entities and relationships · knowledge graph visualization · hub and path analysis · runs locally
4. 04osint normalizerpaste osint dump · extract emails phones ips crypto handles · disposable tor private heuristics · e.164 · five tabs · per-category csv · runs locally
5. 05natural language writing sample authorship comparatordrop multiple text files or paste writing samples · compute 40 plus stylometric features · sentence length distribution · vocabulary richness · function word frequencies · punctuation patterns · produce similarity score with confidence intervals between samples · runs locally
6. 06ios significant locations forensic extractordrop routined Cache.sqlite · parse significant places visits · home work inference · visit timeline · runs locally
7. 07android google timeline artifact forensic extractordrop Google Timeline JSON, Takeout location history files, semantic location history exports, or Maps activity artifacts · parse places, visits, activity segments, coordinates, confidence values, and edit metadata · reconstruct Google-derived movement history · runs locally
8. 08domain reputation analyzerpaste domains or IPs · score by entropy · TLD risk · homoglyph detection · DGA patterns · punycode abuse · age heuristics · no external lookup · runs locally

go deeper