creator safety · stalker & NCII — quick-start

checklist

1. confirm the victim is safe — if in immediate danger, call 911; if the stalker knows the victim's location, prioritize physical safety over evidence collection.
2. preserve every contact attempt from the stalker: booking platform messages, phone numbers used, social media accounts, emails, and any off-platform messages.
3. note the escalation pattern: moved from booking platform to personal contact, off-platform threats, or real-world proximity — this is the core of the timeline.
4. screenshot the stalker's booking platform profile before reporting — platforms often remove profiles after a report, taking the evidence with them.
5. export the full message thread from the booking platform before any report — use the platform's export function if available; screenshot otherwise.
6. note whether the stalker has used real-world information obtained from the booking: real name, address, employer, or social media not provided by the victim.
7. preserve any reviews left by the stalker — review content and timing relative to the escalation pattern is evidence.
8. check whether the same contact information appears across multiple booking platforms — cross-platform correlation may identify additional victims.
9. do not block the stalker until evidence is preserved — blocking can prevent further documentation and may escalate behavior without warning.
10. begin the primary tool path below — stalker timeline correlator and identity cross-reference tool.

primary tools

1. 01evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
2. 02doxxing victim investigation kitdrop social posts + pii exposure logs + threat messages · build victim safety report · runs locally
3. 03sextortion ncii investigation kitdrop extortion messages + payment demands + platform reports · build ncii case package · runs locally
4. 04sextortion takedown notice package generatordrop incident evidence · output platform-specific takedown notice templates · runs locally
5. 05payment processor subpoena response normalizer stripedrop stripe subpoena response · parse merchant + transaction artifacts · runs locally
6. 06payment processor subpoena response normalizer paypaldrop paypal subpoena response · parse account + transaction artifacts · runs locally
7. 07ai generated image provenance analyzerpng tEXt chunk inventory · sd metadata · stripped metadata flag · provenance csv · runs locally
8. 08ela image tampering detectordrop a JPEG · error level analysis · detect localized re-compression · flag tampered regions · visualize ELA map · runs locally

go deeper