TLP:CLEAR // Xservus Limited // Public-case reconstruction — unrestricted disclosure permitted
XSERVUS/ Attribution Simulator/ mr-r3b00t

The VPN hides the path.
The device tells on itself.

A live, step-through reconstruction of how a persistent Windows device identifier (GDID) defeated network-layer anonymity in US v. Stokes. Watch two traffic planes run in parallel: the operational path the attacker tunnels through a VPN, and the first-party OS telemetry that never enters the tunnel at all.

Speed
EVENT 00 / 11  ·  --:-- UTC
Phase 0 · Setup
Phase 1 · Intrusion (12 May 25)
Phase 2 · Collapse (weeks later)
Phase 3 · Attribution
OPERATIONAL PLANE — routed through VPN
OS TELEMETRY PLANE — first-party, bypasses VPN
Windows PC · operator
GDID g:6755467234350028
VPN: OFFLINE
VPN Proxy
Tzulo · Mount Prospect, IL
exit …168
ngrok / Company F
tunnel + data-centre (NJ)
sees only …168
Microsoft Telemetry
first-party endpoints
logs GDID + IP + timestamp
FBI · Correlation
facts linked: 0 / 6
TEMPORAL MATCH
GDID ↔ ngrok signup · same minute
Operational traffic (via VPN)
OS telemetry (no VPN)
Out-of-band (vishing)
Legal process / referral
READY Press Play to run the reconstruction, or Step through one event at a time.

Operational plane — "what the VPN shows"

awaiting traffic…

Telemetry plane — "what Microsoft sees"

awaiting device check-ins…

Correlation engine

  • ✓Device ↔ event: GDID loaded ngrok signup at the exact minute the attack account was created.
  • ✓VPN bypassed: telemetry carried a real device ID while the operational IP showed only …168.
  • ✓Same GDID, home IP: device later checked in from a residential Tallinn address (VPN off).
  • ✓Account overlap: those IPs authenticated to Apple, Snapchat, Facebook & Ubisoft accounts.
  • ✓Physical presence: geolocated Snapchat imagery + State Dept travel records place him in NY & Thailand.
  • ✓Legal process: Microsoft referral + reverse §2703(d) order returned the full account graph.
Identity
UNRESOLVED
Reconstruction, not surveillance capture. This simulator dramatises the sequence and correlation logic described in the unsealed US v. Stokes complaint (No. 25 CR 812, N.D. Ill.). Timings are compressed and the topology is stylised for teaching. The core mechanism is accurate: OS telemetry to first-party endpoints does not traverse a user's VPN, and a persistent device identifier plus a shared timestamp is enough to pierce network-layer anonymity. Allegations are unproven; presumption of innocence applies.