The man in the Cybertruck.
Was the email real?
On New Year's Day 2025 a decorated Green Beret shot himself in a rented Cybertruck outside the Trump International Hotel in Las Vegas, moments before its improvised payload of fireworks and fuel went off. Within days an email circulated that claimed to come from him, written the morning before. A widely followed analyst called it a fake, with reasons. Working from the sender address alone, the firm reached the same named person by three independent paths in an afternoon. The email was real.
A message nobody could vouch for, in a week nobody could afford one.
The explosion came within hours of the Bourbon Street attack in New Orleans. Two veterans, the same base, trucks rented through the same app, the same date. Before any official motive, the coincidences were being stitched into connected plots, foreign hands and false flags by accounts with very large followings. The FBI's eventual position was that the Las Vegas incident was a tragic suicide by a combat veteran struggling with PTSD, and that the two attacks were unconnected.
Sent the morning before
Dated 31 December, 10:42, with an instruction not to release it until 1 January. It said the writer was not under duress, was heading for the Mexican border and believed he was being tracked, set out a theory about foreign drones over the east coast, and claimed knowledge of airstrikes and cover-ups in Afghanistan. It signed off with a LinkedIn name. None of that appeared in the note the police released.
Declared a fake, with reasons
A data-analysis YouTuber with a large audience judged it fabricated: the source had circulated misinformation before, the email would raise the profile of whoever made it, and the screenshot showed spellcheck underlining under words like gravitic and CENTCOM, as if it were still being edited. Sound reasoning. Not evidence.
A window, or a forgery
If real, the email was the clearest view anyone had of the man's state of mind, and proof that the two attacks had nothing to do with each other. If fake, it was more fuel. Newsrooms had to decide which before repeating a word of it, and the deciding had to be done on evidence, which is what the firm does.
Four lookups. Three paths to the same person.
Account registration signals are what a mail address or a phone number gives away about the accounts it anchors: which services it is registered with, and a masked hint of the other identifiers on the same account. Each lookup below was run on 4 January. Identifiers are shown as the tools mask them, and the full values are not reproduced on this site.
The sender address
The email was sent from an address at an anonymous mail provider. That address was the only thing to work from, and the first lookup was run on it alone.
Tesla registered
Instagram registered · Protonmail registered
The name, on a people-search site
The address pointed at a name, and a routine people-search lookup on that name, in the city the subject was known to live in, returned a listing with a phone number.
City consistent with the subject
One phone number, ending 84
The number, run back through the registries
The number from the listing was then run on its own, with no name attached, to see whose accounts it anchored.
Apple registered · email hint m***@g***.com
The second mailbox, guessed and confirmed
The Apple hint implied a mainstream mailbox beginning with m. The plainest guess, first name dot surname, was run as its own lookup.
Facebook registered · phone hint *********84
Apple phone hints ***84, ***19
Samsung phone hint +1 7** *** **84
What converged
The sender address carried a phone hint ending 84. A number ending 84, listed to the subject's name in his city, carried an email hint that matched the sender address letter for letter where it was unmasked. A second mailbox, guessed from an Apple hint and confirmed on four more registries, carried the same ending 84 again. Three separate routes, one person.
What it did not say
That the claims in the message were true. Authorship was the question and the evidence reached it. The contents were a different question, and no assessment was offered because the evidence did not reach them. The Tesla registration on the sender address did corroborate one thing: a man who had an account with the company was not making a statement about the brand.
A simple, rudimentary workflow can do a lot.Colby Scullion, to OSINT Industries
What disappeared between the 4th and the 8th.
The number was run again four days later. Signals that are being removed are evidence of their own: an account that is taken down after a death was an account that belonged to the person who died.
- Truecaller · registered · name, city, carrier
- AT&T · registered · Colorado Springs
- Instagram · registered
- Apple · registered · email hint m***@g***.com
- Twitter · registered
- Facebook · registered · name M... L... · email hint d*****b@p*******.com
- Facebook · a second registration
- Truecaller · registered · name, city, carrier
- AT&T · registered · Colorado Springs
- Apple · registered · email hint m***@g***.com
- Instagram · registered
- Twitter · registered
- Facebook · name M... L... · email hint d*****b@p*******.com
- Facebook · a second registration
The Facebook registrations that carried the name and the matching email hint were gone within four days. The carrier, phone and Apple signals remained. Facebook had taken down the identifying content quickly. The lookup on the 4th was faster.
A correction, and a question that could now be asked.
The analyst who had called the email a fake corrected himself in public and apologized, then traced the now-verified address to a review the man had left years earlier for a treatment centre, mentioning anxiety, depression, PTSD and a brain injury. The signs had been there. Verification made them findable.
The first information you can get
Open-source and social-media evidence is almost always the first quality information available after a crisis. Early reporting had used it to find the shared rental app and the shared base, and had stopped there. The coincidences needed more investigation, not less.
Verification is what trips investigators up
Not collection. A people-search site returns thirteen phone numbers and the right one is at the bottom. The practice is in knowing which signals corroborate each other and which only look as if they do.
Hard to poison the well
A civilian with no clearances built a profile of both New Year's Day attackers in days. With the tools and a trained analyst, a bad actor has to go to a great deal of effort to control the narrative, because the record can be checked.
If you have the tools and a trained analyst, you really have to go to a lot of effort to poison the well.Colby Scullion, to OSINT Industries
The case study, the record, the video.
The man in the Cybertruck: OSINT decodes the final message
OSINT Industries, 13 March 2025. The verification step by step, the misinformation it cut through, and the case for OSINT as first-response intelligence.
Read the case study ↗ On the recordThe matter, as Groundtruth tells it
The question, the finding, the confidence and the so-what, beside the DogeQuest matter, on the Groundtruth page. This page replaces the firm's January 2025 research post.
Groundtruth → VideoThe verification, on camera
The investigation walked through on YouTube.
Watch ↗The firm's working file for this matter carries the subject's and his family's identifiers in full. It is not hosted here and they are not printed above. The Groundtruth page says the same →
Bring us the thing you cannot vouch for.
Groundtruth answers whether a message, an account or a claim is what it says it is, and says plainly where the evidence stops. This matter was published because the person at the end of it was already named by the authorities; client matters never are.
The sender was the finding.