Using open-source tools, GIOC investigators traced the scam back to a domain, a crypto wallet, and, thanks to a brief VPN glitch, an exposed IP address.