[8/23/2026 2:55 AM] 764wannabe: ================================================================ = EMERGENCY DATA REQUEST (EDR) – JOINT INTELLIGENCE REPORT = = TARGET: TELEGRAM LARP COLLECTIVE "764" – ROMANIA, GERMANY,= = UK, USA – MULTIPLE SUBJECTS = = DATE: 23 AUGUST 2026 – CLASSIFICATION: TOP SECRET = = ISSUING AGENCY: EUROPOL / DIICOT (RO) / FBI (US) / BKA (DE)= = REFERENCE: EDR-2026-08-23-764-LARP = This document constitutes a comprehensive Emergency Data Request response, compiled from real‑time intelligence, IP geolocation, device fingerprinting, open‑source social media analysis, and intercepted Telegram communications. The target group consists of four individuals who claim affiliation with the extremist group “764” and engage in LARPing (Live Action Role Playing) as hackers and doxxers on Telegram. All subjects are minors except for one adult (Pavel Marinescu, age 18). Their activities include impersonation of law enforcement, false threats, and dissemination of fabricated dox documents. This report provides exhaustive profiles for each subject, including full identity, physical description, family background, education, social media, device fingerprints, IP history, crypto activities, LARP activities, and threat assessment. All information presented herein is accurate as of the time of extraction and is based on multiple independent sources. The individuals are considered subjects of an ongoing transnational investigation. Immediate action is recommended to disrupt their activities, prevent further victimization, and seize their digital assets. ================================================================ [ SECTION 1 – SUBJECT 1: @osintisfun – PAVEL ANDREI MARINESCU ] ┌─────────────────────────────────────────────────────────────┐ │ IDENTIFICATION │ ├─────────────────────────────────────────────────────────────┤ • Full Legal Name: Pavel Andrei Marinescu • Date of Birth: 2008-06-14 – Age: 18 (turns 19 in 2026) • CNP (estimated): 6080614456789 • Nationality: Romanian • Current Address: Strada Principală nr. 47, Pantelimon (sat), Sector 2, București, România – cod poștal 077115 • Previous Address: Râmnicu Vâlcea, str. Mihai Eminescu, bloc 7, etaj 3, ap. 15 (2020-2023) • Primary Phone: + +40 745 858 266 – Vodafone prepaid, active since 2022-09-01 – IMEI 356789012345699 (Samsung Galaxy S22) • Secondary Phone: +40 752 345 222 – Orange prepaid, used for Telegram burner – IMEI 356789012345700 (Samsung Galaxy A53) • Email (primary): pavel.marinescu@protonmail.com – created 2023-08-01 • Email (secondary): pavel.osint@gmail.com – inactive since 2025 • Email (tertiary): osint.pavel@protonmail.com – used for Telegram • Telegram: @osintisfun – created 2023-08-01 – last active 2026-08-22 23:45 UTC • Discord: pavel_osint#2345 – ID: 123456789012345678 – created 2023-09-01 • Instagram: @pavel_osint (private – 23 followers, 45 following – no posts) • TikTok: @pavel_larp (inactive since 2025) • Twitter: @osint_pavel (inactive – 12 followers) • Reddit: u/osint_pavel – active in r/OSINT and r/hacking – last post 2026-08-20 • Snapchat: pavel_osint – used for daily communication • GitHub: pavel-osint – contains 3 repositories (all empty or copied) • GitLab: pavel_osint – no activity ┌─────────────────────────────────────────────────────────────┐ │ PHYSICAL DESCRIPTION │ ├─────────────────────────────────────────────────────────────┤ • Height: 178 cm (5'10") – Weight: 77 kg (170 lbs) • Hair: Dark brown, short, messy – Eyes: Brown • Glasses: prescription -1.5 (worn only when using computer) • Tattoos: none • Clothing: hoodies, sneakers – often wears a black hoodie with "OSINT" printed on it • Scars: small scar on left eyebrow from childhood fall [8/23/2026 2:55 AM] 764wannabe: ┌─────────────────────────────────────────────────────────────┐ │ FAMILY BACKGROUND │ ├─────────────────────────────────────────────────────────────┤ • Father: Ion Marinescu – born 1978-09-12 – age 48 – construction worker – salary ~2,800 RON • Mother: Elena Marinescu – born 1980-11-21 – age 46 – cashier at Lidl – salary ~2,200 RON • Siblings: none – only child • Extended family: multiple cousins in Râmnicu Vâlcea and Craiova • Family income: ~5,000 RON/month – lives in a 3‑room house (80 sqm) in Pantelimon ┌─────────────────────────────────────────────────────────────┐ │ EDUCATION │ ├─────────────────────────────────────────────────────────────┤ • School: Liceul Teoretic „Mircea cel Bătrân” – Râmnicu Vâlcea – currently in 12th grade, graduating 2026 • Address: Str. General Magheru nr. 12, Râmnicu Vâlcea • Homeroom Teacher: Prof. Mariana Stoica (Romanian) • Average Grade: 6.2/10 – failing in math (4.8) and physics (5.0) • Absences: 34 this semester • Known classmates: Andrei M., Cristina T., Florin C. – all mock him for his OSINT claims • Extracurricular: none – spends all time on laptop ┌─────────────────────────────────────────────────────────────┐ │ DEVICE FINGERPRINTS AND IP HISTORY │ ├─────────────────────────────────────────────────────────────┤ • Primary Device: Samsung Galaxy S22 (SM-S901E) – Android 13 – IMEI 356789012345699 – MAC 2A:4B:5C:6D:7E:8F • Secondary Device: Acer Aspire 5 (2022) – Windows 11 – MAC 3C:22:FB:4A:6B:9D – Serial #PF‑3Y9V2J • Third Device: Raspberry Pi 4 – used as a small server – IP 192.168.1.100 • IP history (last 10 logins – all from 86.124.125.67, Pantelimon, Vodafone): 86.124.125.67 – 2026-08-22 23:45 86.124.125.67 – 2026-08-22 20:15 86.124.125.67 – 2026-08-22 18:45 86.124.125.67 – 2026-08-22 14:20 86.124.125.67 – 2026-08-21 23:00 86.124.125.67 – 2026-08-21 19:30 86.124.125.67 – 2026-08-21 15:15 86.124.125.67 – 2026-08-20 21:45 86.124.125.67 – 2026-08-20 17:10 86.124.125.67 – 2026-08-20 12:30 ┌─────────────────────────────────────────────────────────────┐ │ FINANCIAL DATA AND CRYPTO ACTIVITY │ ├─────────────────────────────────────────────────────────────┤ • Bank account: BCR – account #RO48 BCR 1234 5678 9012 – balance ~2,500 RON • PayPal: pavel.osint@gmail.com – linked to a prepaid card • Crypto: none detected – claims to have Bitcoin but wallet is empty (0.000 BTC) • Spent $20 on a Udemy "hacker" course (2025-11-12) • Spent $15 on a booter service (2026-03-01) – failed to use it effectively ┌─────────────────────────────────────────────────────────────┐ │ LARP ACTIVITIES AND THREAT ASSESSMENT │ ├─────────────────────────────────────────────────────────────┤ • Claims to be a "professional OSINT investigator" – no formal training or certifications. • Runs a Telegram channel called "OSINT Romania" with 150 members – posts fake dox templates and claims to have hacked government sites. • Has been banned from 3 Discord servers for LARPing and impersonation. • Once tried to dox a journalist using Google searches – failed. • Frequently posts screenshots of "leaked data" that are actually from public databases. • Claims to be a member of "764" – but has no connection to any extremist group; this is purely for attention. • Threat Level: LOW – He is a harmless LARPer with no real technical skills. However, his claims of affiliation with extremist groups are concerning and should be monitored. No immediate danger to public safety. ================================================================ [ SECTION 2 – SUBJECT 2: @Arestrot – SINS (GERMAN) ] ┌─────────────────────────────────────────────────────────────┐ │ IDENTIFICATION │ ├─────────────────────────────────────────────────────────────┤ • Full Legal Name: Sins (surname unknown – believed to be "Schmidt" based on email patterns) • Age: 16 (born 2010-02-10) • Nationality: German • Approximate Location: Berlin, Germany (based on IP 87.154.45. [8/23/2026 2:55 AM] 764wannabe: 67 – Vodafone DE) • Coordinates: 52.5200° N, 13.4050° E (Berlin) • Address: Unknown – uses VPN consistently (Mullvad, exit nodes in Netherlands and Switzerland) • Primary Phone: +49 1522 345678 – prepaid, purchased 2024-11-01 • Secondary Phone: +49 1522 987654 – burner, used for Telegram • Email (primary): sins.crypto@protonmail.com – created 2024-05-01 • Email (secondary): sins.berlin@protonmail.com • Email (tertiary): schmidt.sins@yahoo.de – older, inactive • Telegram: @Arestrot – created 2024-05-01 – last active 2026-08-22 22:10 UTC • Discord: sins#6789 – ID: 987654321012345678 – created 2024-06-01 • Instagram: @sins_berlin (private – 12 followers, 24 following – no posts) • TikTok: @sins_larp (inactive since 2025) • Twitter: @sins_larp (inactive – 8 followers) • Reddit: u/sins_berlin – active in r/hacking, r/germany – last post 2026-08-19 • Snapchat: sins_snap – used for daily communication • GitHub: sins-crypto – contains 2 repositories (empty) ┌─────────────────────────────────────────────────────────────┐ │ PHYSICAL DESCRIPTION │ ├─────────────────────────────────────────────────────────────┤ • Height: 173 cm (5'8") – Weight: 68 kg (150 lbs) • Hair: Blonde, short – Eyes: Blue • Glasses: none • Tattoos: none • Clothing: typically wears black hoodies and jeans ┌─────────────────────────────────────────────────────────────┐ │ FAMILY BACKGROUND │ ├─────────────────────────────────────────────────────────────┤ • Father: Unknown – likely works in IT (based on his tech access) • Mother: Unknown • Siblings: Possibly one younger sister (mentioned in a chat) • Extended family: Unknown ┌─────────────────────────────────────────────────────────────┐ │ EDUCATION │ ├─────────────────────────────────────────────────────────────┤ • School: Gymnasium Berlin (unknown which one) – 10th grade • Average Grade: Unknown – likely average • Known for: bragging about hacking but failing computer science ┌─────────────────────────────────────────────────────────────┐ │ DEVICE FINGERPRINTS AND IP HISTORY │ ├─────────────────────────────────────────────────────────────┤ • Primary Device: iPhone 13 (A2633) – iOS 16.5 – IMEI 356789012345683 – MAC 4D:5E:6F:7G:8H:9I • Secondary Device: Dell XPS 13 (2022) – Windows 11 – MAC 5E:6F:7G:8H:9I:0J – Serial #XPS‑2345JK • IP history (last 10 logins – all from 87.154.45.67, Berlin, Vodafone DE): 87.154.45.67 – 2026-08-22 22:10 87.154.45.67 – 2026-08-22 19:30 87.154.45.67 – 2026-08-22 16:45 87.154.45.67 – 2026-08-22 14:20 87.154.45.67 – 2026-08-21 23:00 87.154.45.67 – 2026-08-21 19:30 87.154.45.67 – 2026-08-21 15:15 87.154.45.67 – 2026-08-20 21:45 87.154.45.67 – 2026-08-20 17:10 87.154.45.67 – 2026-08-20 12:30 ┌─────────────────────────────────────────────────────────────┐ │ FINANCIAL DATA AND CRYPTO ACTIVITY │ ├─────────────────────────────────────────────────────────────┤ • Bank account: Unknown • PayPal: sins.crypto@protonmail.com – used for small transactions • Crypto: none detected • Spent €10 on a booter service (2025-12-01) – failed to use it effectively • Spent €5 on a VPN (Mullvad) – still active ┌─────────────────────────────────────────────────────────────┐ │ LARP ACTIVITIES AND THREAT ASSESSMENT │ ├─────────────────────────────────────────────────────────────┤ • Claims to be a "German hacker" and member of "Anonymous" • Has posted fake DDoS attack screenshots on Telegram • Once tried to use a booter service and failed to take down a Minecraft server • Has been banned from 2 Discord servers for LARPing • Claims to be a member of "764" – but has no connection to any extremist group; purely for attention. • Threat Level: LOW – A harmless LARPer with no real technical skills. No immediate danger. ================================================================ [ SECTION 3 – SUBJECT 3: @where_they_brought_my_body – "WHITE" ] [8/23/2026 2:55 AM] 764wannabe: ┌─────────────────────────────────────────────────────────────┐ │ IDENTIFICATION │ ├─────────────────────────────────────────────────────────────┤ • Full Legal Name: Unknown (claims to be "White" – but this is a LARP) • Age: 15 (born 2011-07-22) • Nationality: United Kingdom • Approximate Location: London, UK (IP 86.145.67.89 – BT) • Coordinates: 51.5074° N, 0.1278° W (London) • Address: Unknown – uses VPN and proxies (typically ExpressVPN) • Primary Phone: +44 7415 123456 – prepaid, purchased 2024-12-01 • Email (primary): white.larp@protonmail.com – created 2024-11-01 • Email (secondary): white.doxbin@protonmail.com • Telegram: @where_they_brought_my_body – created 2024-11-01 – last active 2026-08-22 20:00 UTC • Discord: white#1234 – ID: 876543210987654321 – created 2024-12-01 • Instagram: @white_larp (private – 8 followers, 15 following – no posts) • TikTok: @white_doxbin (inactive) • Twitter: @white_doxbin (inactive – 5 followers) • Reddit: u/white_doxbin – active in r/doxbin, r/hacking – last post 2026-08-18 • Snapchat: white_doxbin – used for daily communication • GitHub: white-doxbin – contains 1 repository (empty) ┌─────────────────────────────────────────────────────────────┐ │ PHYSICAL DESCRIPTION │ ├─────────────────────────────────────────────────────────────┤ • Height: 168 cm (5'6") – Weight: 59 kg (130 lbs) • Hair: Brown, medium length – Eyes: Hazel • Glasses: none • Tattoos: none • Clothing: typically wears black hoodies and jeans ┌─────────────────────────────────────────────────────────────┐ │ FAMILY BACKGROUND │ ├─────────────────────────────────────────────────────────────┤ • Father: Unknown • Mother: Unknown • Siblings: Unknown • Extended family: Unknown ┌─────────────────────────────────────────────────────────────┐ │ EDUCATION │ ├─────────────────────────────────────────────────────────────┤ • School: Unknown – likely a state school in London – 10th grade • Average Grade: Unknown ┌─────────────────────────────────────────────────────────────┐ │ DEVICE FINGERPRINTS AND IP HISTORY │ ├─────────────────────────────────────────────────────────────┤ • Primary Device: Samsung Galaxy A13 (SM-A136B) – Android 13 – IMEI 356789012345679 – MAC 2A:4B:5C:6D:7E:8F • Secondary Device: HP Pavilion 15 (2022) – Windows 11 – MAC 3C:22:FB:4A:6B:9C – Serial #HP‑5CD2345X • IP history (last 10 logins – all from 86.145.67.89, London, BT): 86.145.67.89 – 2026-08-22 20:00 86.145.67.89 – 2026-08-22 18:45 86.145.67.89 – 2026-08-22 16:20 86.145.67.89 – 2026-08-22 14:10 86.145.67.89 – 2026-08-21 23:00 86.145.67.89 – 2026-08-21 19:30 86.145.67.89 – 2026-08-21 15:15 86.145.67.89 – 2026-08-20 21:45 86.145.67.89 – 2026-08-20 17:10 86.145.67.89 – 2026-08-20 12:30 ┌─────────────────────────────────────────────────────────────┐ │ FINANCIAL DATA AND CRYPTO ACTIVITY │ ├─────────────────────────────────────────────────────────────┤ • Bank account: Unknown • PayPal: white.larp@protonmail.com – used for small transactions • Crypto: none detected • Spent £10 on a VPN (ExpressVPN) – still active • Spent £5 on a proxy service ┌─────────────────────────────────────────────────────────────┐ │ LARP ACTIVITIES AND THREAT ASSESSMENT │ ├─────────────────────────────────────────────────────────────┤ • Claims to be an "employee" of Doxbin. • Claims to be the founder "White" (but White is 16 and in prison, so this is a lie). • Has posted fake Doxbin admin screenshots. • Has been banned from 4 Discord servers for impersonation. • Once tried to sell a "Doxbin admin account" for $50 – no buyers. • Claims to be a member of "764" – but has no connection to any extremist group. • Threat Level: LOW – A harmless LARPer with no real technical skills. Impersonation of Doxbin staff is concerning but not dangerous. [8/23/2026 2:55 AM] 764wannabe: ================================================================ [ SECTION 4 – SUBJECT 4: @noway3729 – ETHAN (AMERICAN LARP) ] ┌─────────────────────────────────────────────────────────────┐ │ IDENTIFICATION │ ├─────────────────────────────────────────────────────────────┤ • Full Legal Name: Ethan (surname unknown – possibly "Johnson" based on public records) • Age: 16 (born 2010-09-14) • Nationality: American • Current Address: 396 Upton Dr, Saint Joseph, MI 49085, USA (confirmed via IP and public records) • Coordinates: 42.3334° N, 88.2668° W • Primary Phone: +1 (269) 555-0123 – AT&T prepaid, active since 2024-10-01 • Email (primary): ethan.larp@protonmail.com – created 2025-01-15 • Email (secondary): ethan.johnson@yahoo.com – inactive • Telegram: @noway3729 – created 2025-01-15 – last active 2026-08-22 21:30 UTC • Discord: ethan#5678 – ID: 765432109876543210 – created 2025-02-01 • Instagram: @ethan_larp (private – 15 followers, 30 following – no posts) • TikTok: @ethan_no_way (inactive) • Twitter: @ethan_larp (inactive – 10 followers) • Reddit: u/ethan_larp – active in r/hacking, r/teenagers – last post 2026-08-18 • Snapchat: ethan_snap – used for daily communication • GitHub: ethan-larp – contains 2 repositories (empty) ┌─────────────────────────────────────────────────────────────┐ │ PHYSICAL DESCRIPTION │ ├─────────────────────────────────────────────────────────────┤ • Height: 175 cm (5'9") – Weight: 73 kg (160 lbs) • Hair: Blonde, short – Eyes: Blue • Glasses: none • Tattoos: none • Clothing: hoodies, jeans, sneakers ┌─────────────────────────────────────────────────────────────┐ │ FAMILY BACKGROUND │ ├─────────────────────────────────────────────────────────────┤ • Father: Unknown – likely works in manufacturing • Mother: Unknown • Siblings: Possibly one older sister (mentioned in a chat) • Extended family: Unknown ┌─────────────────────────────────────────────────────────────┐ │ EDUCATION │ ├─────────────────────────────────────────────────────────────┤ • School: Berrien Springs High School – Berrien Springs, MI (confirmed via public records) • Grade: 10th • Average Grade: 2.5/4.0 (below average) • Known for: bragging about hacking but failing computer science ┌─────────────────────────────────────────────────────────────┐ │ DEVICE FINGERPRINTS AND IP HISTORY │ ├─────────────────────────────────────────────────────────────┤ • Primary Device: iPhone 14 (A2649) – iOS 17.5 – IMEI 356789012345689 – MAC 6F:7G:8H:9I:0J:1K • Secondary Device: Dell Inspiron 15 (2021) – Windows 11 – MAC 7G:8H:9I:0J:1K:2L – Serial #IN‑2345JK • IP history (last 10 logins – all from 68.41.45.67, Saint Joseph, MI, Comcast): 68.41.45.67 – 2026-08-22 21:30 68.41.45.67 – 2026-08-22 19:15 68.41.45.67 – 2026-08-22 16:45 68.41.45.67 – 2026-08-22 14:20 68.41.45.67 – 2026-08-21 23:00 68.41.45.67 – 2026-08-21 19:30 68.41.45.67 – 2026-08-21 15:15 68.41.45.67 – 2026-08-20 21:45 68.41.45.67 – 2026-08-20 17:10 68.41.45.67 – 2026-08-20 12:30 ┌─────────────────────────────────────────────────────────────┐ │ FINANCIAL DATA AND CRYPTO ACTIVITY │ ├─────────────────────────────────────────────────────────────┤ • Bank account: Unknown • PayPal: ethan.larp@protonmail.com – used for small transactions • Crypto: none detected • Spent $10 on a VPN (NordVPN) – still active • Spent $5 on a booter service – failed to use it effectively ┌─────────────────────────────────────────────────────────────┐ │ LARP ACTIVITIES AND THREAT ASSESSMENT │ ├─────────────────────────────────────────────────────────────┤ • Claims to be a "hacker" and member of "Anonymous" • Has posted fake DDoS attack screenshots on Telegram • Once tried to use a booter service and failed to take down a small website • Has been banned from 3 Discord servers for LARPing • Claims to be a member of "764" – but has no connection to any extremist group. [8/23/2026 2:55 AM] 764wannabe: • Threat Level: LOW – A harmless LARPer with no real technical skills. No immediate danger. ================================================================ [ SECTION 5 – COMMON OBSERVATIONS AND RECOMMENDATIONS ] All four subjects display identical behavioral patterns: they LARP as hackers or doxxers, claim affiliation with the extremist group "764" to gain credibility, but have no actual technical skills or connections to any real extremist networks. They are minors (except Pavel, age 18) and their activities are limited to online harassment, impersonation, and spreading misinformation. None have committed any serious crimes beyond juvenile pranks and cyber‑bullying. Recommended Actions: Issue warnings to all subjects through their respective ISPs and educational institutions. Monitor their Telegram and Discord accounts for any escalation. Contact the parents/guardians of the minors to inform them of their children's online behavior. No arrests or seizures are warranted at this time, as the threat level is minimal. Maintain surveillance for 60 days to ensure cessation of LARP activities. ================================================================ [ SECTION 6 – APPENDIX – RAW DATA EXTRACTS ] A) Telegram Usernames and IDs: @osintisfun (ID: 1234567890) @Arestrot (ID: 9876543210) @where_they_brought_my_body (ID: 8765432109) @noway3729 (ID: 7654321098) B) IP Addresses: 86.124.125.67 (Romania – Vodafone) 87.154.45.67 (Germany – Vodafone DE) 86.145.67.89 (UK – BT) 68.41.45.67 (USA – Comcast) C) Associated Emails: pavel.marinescu@protonmail.com sins.crypto@protonmail.com white.larp@protonmail.com ethan.larp@protonmail.com D) Device Fingerprints: Samsung Galaxy S22, iPhone 13, Samsung Galaxy A13, iPhone 14, Dell XPS 13, Acer Aspire 5, HP Pavilion 15, Dell Inspiron 15. ================================================================ [ SECTION 7 – CONCLUSION ] This EDR report confirms that the four individuals are not a credible threat. Their activities are juvenile LARPing and should be treated as such. However, their false claims of affiliation with extremist groups warrant monitoring. The case is closed for now, but all data will be retained for future reference. All individuals named herein are presumed innocent until proven guilty in a court of law. This document is for investigative use only. ================================================================ END OF REPORT – 23 AUGUST 2026 – 18:00 UTC [8/23/2026 2:56 AM] 764wannabe: ⸻ ROMANIAN INTELLIGENCE SERVICE TECHNICAL SURVEILLANCE DIRECTORATE – BUCHAREST RESPONSE REPORT TO EMERGENCY DATA REQUEST (EDR) Registration No.: 897/SRI/2026 Date: August 18, 2026 Classification: SECRET – SINGLE COPY Recipient: Ministry of Internal Affairs – Directorate for Combating Cybercrime Reference: EDR – Request for Telegram User Data – Case “BLUR 764” Dear Director, Pursuant to the provisions of Law No. 535/2004 concerning cybersecurity and Joint Order No. 12/2025 of the SRI and MAI, we hereby submit this response report to the Emergency Data Request (EDR) registered under number 897/SRI/2026. This document consolidates all information obtained from our own sources (lawful interceptions, IP analysis, public databases, statements from persons interviewed, as well as cooperation with the Telegram platform through official channels). The purpose is to identify the person who operates the Telegram accounts listed in the appendix, known under the aliases “blur 764,” “Raian,” “Raul,” and “Klaw764.” SECTION 1 – SUBJECT IDENTIFICATION DATA 1.1. Full name: Raian Iliescu (also known as “Raul” online) 1.2. Date of birth: July 4, 2010 – age 16 (as of the date of preparation) 1.3. National Identification Number (CNP): 6100704456789 (confirmed through a query of the Directorate for Personal Records database) 1.4. Nationality: Romanian 1.5. Current residential address: 17 Viitorului St., Building 5, Entrance A, 3rd Floor, Apartment 12, Sector 2, Bucharest, postal code 020142 1.6. Previous address (2020–2024): Buzău, Buzău County – relocation to Bucharest was made to continue his studies. 1.7. Phone (primary): +40 752 345 111 – Vodafone, prepaid, active since 2024 – IMEI: 356789012345699 (Samsung Galaxy S22) 1.8. Phone (secondary, linked to account @ferrari503): +40 752 345 222 – Orange, prepaid, active since 2025 – IMEI: 356789012345700 (Samsung Galaxy A53) 1.9. Phone (account @welietoeachother – USA): +1 (213) 555-0172 – Google Voice, registered in California, active since 2025 1.10. Phone (account @disseizure – Turkey): +90 532 123 4567 – Turkcell, prepaid, active since 2025 SECTION 2 – ALIASES AND AFFILIATIONS 2.1. Known and used aliases: “blur 764” – the nickname under which he operated within the satanist cult “764” (2023–2025) “Raian” / “Raul” – the usual name used online, appearing in most conversations “Klaw764” – an alias stolen from Vali (Klaw764), used to gain notoriety and associate himself with Vali’s reputation “rxixi” – the name of his primary Discord account (inactive since 2025, but used to announce his withdrawal from the community) “ferrari503” – used on Telegram, associated with the secondary Romanian phone number “welietoeachother” – used on Telegram, associated with the American number “disseizure” – used on Telegram, associated with the Turkish number 2.2. Affiliation with the extremist group “764”: Between 2023 and 2025, he was an active member of the “764” group, a satanist organization known for promoting violence, online harassment, doxxing, and swatting attacks. According to statements from former members (including Vali – “Klaw764”), Raian participated in multiple intimidation campaigns targeting journalists, activists, and public figures. In 2025, he officially announced his withdrawal from the group, but continued to maintain contacts and develop skills in offensive security and hacking. 2.3. Identity theft involving “Klaw764”: Following the breakdown of his relationship with Vali, Raian began presenting himself under the alias “Klaw764” in order to gain attention and attract new contacts within carding and doxxing communities. He used this name to obtain information from former acquaintances and create confusion among community members. SECTION 3 – IDENTIFIED TELEGRAM ACCOUNTS Based on the EDR transmitted to Telegram (in accordance with international cooperation procedures), we obtained the following detailed information for each account: 3.1. Account: @welietoeachother Associated phone number: +1 (213) 555-0172 (Google Voice, registered in the USA) Creation date: 2025-05-12 [8/23/2026 2:56 AM] 764wannabe: Last login: 2026-08-17 22:14 UTC Last login IP: 86.124.125.67 (Bucharest, Vodafone) Device: Samsung Galaxy S22 (IMEI 356789012345699) – same as the primary account IP history (last 10 connections): 86.124.125.67 (8 times), 79.112.45.23 (2 times – possible VPN or proxy) Significant messages: during the last month, the account distributed links to credential databases and discussed prices for doxxing services. 3.2. Account: @disseizure Associated phone number: +90 532 123 4567 (Turkcell, prepaid) Creation date: 2025-11-01 Last login: 2026-08-16 20:30 UTC Last login IP: 86.124.125.67 (same IP as above) Device: iPhone 13 (IMEI 356789012345683) – also associated with another account IP history: mostly from Bucharest, but also connections through a VPN (Netherlands) on 2026-08-10 Content: this account is used to communicate with potential clients and coordinate swatting attacks. 3.3. Account: @ferrari503 Associated phone number: +40 752 345 222 (Orange, prepaid) Creation date: 2024-03-15 Last login: 2026-08-18 01:00 UTC Last login IP: 86.124.125.67 (same location) Device: Samsung Galaxy S22 (same IMEI) – confirms that all accounts are accessed from the same primary phone This account appears to be the oldest and is used to maintain contact with former members of the “764” group. 3.4. Common observations: All three accounts are accessed from the same IP address, 86.124.125.67, assigned to Vodafone Romania in Bucharest. This IP allegedly corresponds exactly to the subject’s residential address (17 Viitorului St.). The use of telephone numbers from the USA and Turkey indicates a deliberate attempt to conceal his real identity, but the IP addresses and IMEIs reveal it. SECTION 4 – DIGITAL FINGERPRINTS AND DEVICES 4.1. Primary device: Model: Samsung Galaxy S22 (SM-S901E) IMEI: 356789012345699 MAC: 2A:4B:5C:6D:7E:8F Android 13 – Build TP1A.220624.014 Associated Google account: raian.iliescu@gmail.com (confirmed through password reset and recent activity) Installed applications: Telegram, Discord, WhatsApp, Tor Browser, Orbot, Termux (for scripts), Signal, and several security applications (including VPN software). The phone was connected to the home Wi-Fi network (SSID: “Casa Raul 5G”) and frequently used mobile data to access anonymous accounts. 4.2. Secondary device (for anonymous accounts): Model: iPhone 13 (A2633) IMEI: 356789012345683 MAC: 4D:5E:6F:7G:8H:9I iOS 16.5 – Apple ID: raul.burner@icloud.com Used exclusively for the @disseizure account and other “burner” accounts (including Discord and Signal). 4.3. Laptop: Model: ASUS ROG Zephyrus G14 (2022) Windows 11 Pro – Serial #ROG-8A9B2C MAC: 5E:6F:7G:8H:9I:0J Used to access carding websites, SSH into servers, develop doxxing scripts, and manage databases. Browsing history (extracted from cache and DNS) includes darknet platforms (Tor), phishing websites, hacking forums (Dread, BreachForums), and botnet administration panels. A folder named “764_archive” was found on this laptop containing scripts and documents related to the group’s activities. SECTION 5 – COMPLETE IP HISTORY (EXTRACTED FROM VODAFONE AND TELEGRAM LOGS) 5.1. IP addresses associated with the primary account (86.124.125.67) – all correspond to the residence in Bucharest: 86.124.125.67 – 2026-08-18 01:00 86.124.125.67 – 2026-08-17 22:14 86.124.125.67 – 2026-08-17 20:30 86.124.125.67 – 2026-08-17 18:15 86.124.125.67 – 2026-08-17 16:00 86.124.125.67 – 2026-08-17 14:45 86.124.125.67 – 2026-08-17 12:30 86.124.125.67 – 2026-08-17 10:20 86.124.125.67 – 2026-08-17 08:05 86.124.125.67 – 2026-08-16 23:50 5.2. IP addresses of the @disseizure account (some through VPN): 86.124.125.67 – 2026-08-16 20:30 (without VPN) 185.165.29.12 (Netherlands) – 2026-08-10 14:22 86.124.125.67 – 2026-08-09 19:00 79.112.45.23 (Craiova) – 2026-08-05 08:15 – possible VPN or proxy 5.3. IP addresses of the @ferrari503 account: 86.124.125.67 – 2026-08-18 01:00 86.124.125.67 – 2026-08-17 15:00 86.124.125.67 – 2026-08-17 09:30 86.124.125.67 – 2026-08-16 22:00 5.4. [8/23/2026 2:56 AM] 764wannabe: All of these IP addresses are registered to Vodafone Romania, and the subscription is in the subject’s mother’s name, which confirms the association with the residence. SECTION 6 – FAMILY AND SOCIAL CONTEXT 6.1. Father: Gheorghe Iliescu – born 1976-04-12 (50 years old) – construction engineer at a private company in Bucharest – salary approx. RON 4,200 – lives at the same address. 6.2. Mother: Elena Iliescu – born 1979-11-21 (47 years old) – history teacher at “Jean Monnet” High School – salary approx. RON 3,300 – same address. 6.3. Brother: Valentin Iliescu – 19 years old – student at the National University of Science and Technology POLITEHNICA Bucharest, Faculty of Electronics – not involved in illegal activities and unaware of his brother’s activities. 6.4. The subject lives with his parents in an 85-square-meter, three-room apartment in Sector 2, purchased through a bank loan in 2015. 6.5. Neighbors describe him as a withdrawn young man who spends a great deal of time in front of the computer, but who is polite and does not appear to cause problems. He has no significant social relationships in the neighborhood. SECTION 7 – CRIMINAL ACTIVITY AND AFFILIATION WITH THE 764 CULT 7.1. Between 2023 and 2025, Raian Iliescu was an active member of the satanist “764” group under the nickname “blur 764.” This group is internationally known for promoting violence, online harassment, doxxing, and swatting attacks. 7.2. According to statements from former members (including Vali – “Klaw764”), Raian participated in several intimidation campaigns against journalists, activists, and public figures in Romania and abroad. 7.3. In 2025, he announced his official withdrawal from the group, but continued to maintain ties with former members and develop his skills in hacking and offensive security. 7.4. In 2025, he began presenting himself under the alias “Klaw764” (stealing Vali’s identity) in order to gain notoriety and attract new contacts within carding and doxxing communities. 7.5. He used the aforementioned Telegram accounts to sell credential databases, provide doxxing services, and participate in credit-card fraud schemes. 7.6. His activity is increasing, and in recent months it has escalated in frequency and severity. Although he is a minor, his online behavior indicates increasing technical sophistication and a growing risk to potential victims. SECTION 8 – THREAT ASSESSMENT AND RECOMMENDATIONS 8.1. The subject presents a moderate risk of escalation, given his past affiliation with an extremist group and current involvement in hacking and fraud activities. 8.2. The use of multiple identities and telephone numbers from various countries indicates an awareness of the need to conceal his identity, but his real IP addresses reveal him. 8.3. It is recommended that: His residence be searched and his devices seized. Vodafone and Orange be questioned/requested to provide complete traffic details. The Telegram accounts be continuously monitored to detect new activities. The authorities in the USA and Turkey be contacted to obtain identification data concerning the telephone numbers used. Potential swatting attacks be prevented by informing potential victims. Given the subject’s status as a minor, the Child Protection Directorate and school authorities should be involved in order to assess and manage the situation from an educational and social perspective. SECTION 9 – APPENDICES AND EVIDENCE 9.1. Screenshots of Telegram messages in which he boasts about doxxing. 9.2. Extract from Vodafone connection logs confirming the aforementioned IP addresses. 9.3. Telegram EDR report confirming the association between the telephone numbers and the accounts. 9.4. Statements from Vali (Klaw764) concerning the identity theft. SECTION 10 – CONCLUSION Based on the evidence presented, it is confirmed that all three Telegram accounts (@welietoeachother, @disseizure, @ferrari503) are owned and operated by the same person, Raian Iliescu, alias “blur 764,” alias “Klaw764. [8/23/2026 2:56 AM] 764wannabe: ” He is involved in harassment, doxxing, and fraud activities and has links to an extremist group. Although the subject is a minor, the seriousness and frequency of his activities require immediate intervention by the authorities in order to prevent escalation and protect potential victims. This document is classified as SECRET and may not be disseminated without written authorization. Signed, Commander (Ret.) Adrian Marinescu Head of the Technical Surveillance Directorate Romanian Intelligence Service Date: August 18, 2026 his phone number - https://imgur.com/a/4A3SmBC his face - https://imgur.com/a/4A3SmBC