Bank-statement formatting under Tony’s name
Cybertrace describes an account named Tony Smith asking for an ANZ bank statement to copy its formatting. The account says it bought one on the dark web and that “it is for dodgy stuff”. Cybertrace inferred an attempt at fraud, but did not confirm that it was completed.
Cybertrace 2025-4663 · original PDF pp. 4–5; screenshot appendix p. 53 · 3 June 2025
Tony connects the bank-statement exchange to his reports of identity misuse and documents manipulated for use as evidence.
Tony’s account in this review · 3 October 2026; Cybertrace 2025-4663 · original pp. 4–5 · 3 June 2025
What Cybertrace found
Cybertrace found drug advertising by Telegram accounts using Tony Smith’s name and recommended obtaining platform and provider records. Tony identifies Rushton as the operator. His records include bot notices linking kandykingX to The_real_Tony_smith through one account ID, CCTV posted under Tony’s name, a video in which he identifies Rushton and WhatsApp messages. Tony says the number ending 368 connects Rushton to the main Telegram drug-selling account.
Tony says he gave police much more material than he gave Cybertrace. He limited his input to Cybertrace because he wanted the private investigator to assess the material independently.
Tony Smith · explanation supplied for this review · 4 October 2026
Cybertrace public extract · PDF pp. 1–2 and 4–5 · full report 2025-4663 dated 3 June 2025; tracking event 30 April 2025
What Cybertrace asked authorities to investigate
It is particularly critical that authorities investigate the matter of the user linked to this IP address who has used Telegram to promote the sale of narcotics using the name of the Client.
Cybertrace public extract · PDF p. 5, Recommendations · event dated 30 April 2025; full report 2025-4663 dated 3 June 2025
The report recommends requesting the two accounts’ records from Telegram. It also recommends a Forensic Data Request to Swoop and Anycast Holdings for the user of the captured IP address at 11.04 AM AEST in Sydney on 30 April 2025. Because multiple users may share that address, Cybertrace says browser histories, network traffic and system logs need analysis to identify the relevant activity.
Cybertrace public extract · PDF pp. 4–5, Recommendations · 30 April 2025 event
Cybertrace public extract · PDF pp. 4–5, Recommendations · full report 2025-4663 dated 3 June 2025
The Teams exchange before the hearing
Tony identifies the other Teams participant as Rushton. He says that, before a hearing, Rushton contacted him using Tony’s name, said he was now Tony Smith and questioned who Tony was. Tony recalls the contact occurring on the day the account was created.
Tony’s account supplied in this review · 3 October 2026 · hearing and exact first-contact date awaiting clarification
Cybertrace’s Microsoft-account table lists the name Anthony Smith and a creation date of 12 November 2024. The following page links the Microsoft account to the suspect’s email address and describes this as evidence of using the client’s identity.
Cybertrace 2025-4663 · original PDF pp. 20–21 · 3 June 2025; table records creation date 12 November 2024
Who are you talking to? I’m Anthony Smith
Retained Teams screenshot composite · message displayed under 13 November 2024 at 06:48 · filename: MS Teams Anthony Smith Alias Creation Date 12 November 2024.jpeg
The screenshot shows Teams activity on 12 November 2024 and the quoted message on 13 November at 06:48.
Retained Teams screenshot composite · displayed activity 12 November 2024 at 04:23 and 10:11; quoted message 13 November 2024 at 06:48 · timezone not shown
Tony’s account · 3 October 2026; Cybertrace 2025-4663 · original pp. 20–21 · 3 June 2025
Why Tony identifies the Telegram accounts as Rushton’s
Tony identifies Rushton as the operator using his name and supplies account-history, CCTV, video and WhatsApp evidence together. His identification is based on these links, rather than on the display name alone.
Tony Smith’s account and seven supplied files · 4 October 2026
The SangMata bot screenshot records Telegram user 7515693902 changing its name from King Anthony Kandy to Tony Smith and its username from kandykingX to The_real_Tony_smith. The same numeric ID appears in both notices.
SangMata screenshot · name-change notices under January 16, 14:51; year not displayed · supplied 4 October 2026
A Sydney Lads Up Late screenshot shows a CCTV image posted under Tony Smith on 20 July 2024, followed by “Anyone recognise this gent”, “Who is he” and “He's been creeping around my apartment”. Tony identifies the camera location as outside Rushton’s unit and the man as standing at the neighbouring door. He also identifies Rushton and his voice in the supplied video, which he says was posted to the same group using Tony’s name.
Sydney Lads Up Late CCTV screenshot · post 20 July 2024, 16:32–16:35; camera overlay 2024-07-18 19:28:45 · video and Tony’s identification supplied 4 October 2026
The WhatsApp screenshot displays a contact named Mr Issac william Rushton with a number ending 368. Tony identifies that number as Rushton’s and says it is also used by the main Telegram drug-selling account. The visible conversation includes “It's me” and “It's me babe”.
WhatsApp contact and conversation composite · displayed conversation Tue, 6 May; sidebar 6/5/2025 · supplied 4 October 2026; cross-platform number link identified by Tony
Cybertrace’s 3 June 2025 report described the operators of @frost_rich and @the_real_Tony_smith as unconfirmed. Tony identifies Rushton and supplied the account-history, CCTV, video and WhatsApp records in October 2026.
Cybertrace 2025-4663 · original PDF pp. 48–52 · 3 June 2025; Tony’s account and supplied records · 4 October 2026
Where this came from
| Source | Cybertrace assessment and recommendations, signed Dan Halpin, CEO |
|---|---|
| Document identifier | cybertrace-forensic-report-public-extract.pdf, retained public extract |
| Date | Full report: 3 June 2025, Ref. 2025-4663. Tracking event: 30 April 2025. |
| PDF extent | 11 pages; findings on PDF pp. 1–2, recommendations on pp. 4–5 |
SHA-256
67be80e47e09d709d7e81152d59a2bcc544a583cb5bd8c8fe6909212aff79eab
Summary PDF: a two-page selection of Tony’s requested assessment passages, checked against pages 1–5 of the 11-page public extract (pages 48–52 of the full 67-page report). Quotations and paraphrases are labelled. Personal emails and phone numbers are omitted. This private derivative is not publication-cleared; the original is unchanged.
Summary excerpt SHA-256
427191346462de8e103c2f628701b46c5e71ef31b01faf38703222e53767fdba
Source PDF retained privately.