Fingers flew over the keys as Paddy worked into the night, losing all clue about time. He built a script to correlate sending times with known server behavior, cross-referenced metadata from similar emails across dark web dumps. Patterns emerged.

Then: an IP fragment buried in an overlooked X-Originating header, likely a misconfigured node in the hacker’s proxy chain. Not enough to identify, thought Paddy, chewing his lip with growing excitement, but a starting point.

He leaned ...