Intro

Here are the rules:

Never break the law
Avoid reporting to the police unless someone is in physical danger
Don't do this from home: use a VPS, shell account, or bouncer
Never reveal your personally identifiable information
If you make a phone call, hide your personal number
If you send an email, use a disposable email
If you visit a shady website, disable all javascript

Setting up irssi to connect via tor:

$ tmux
$ doas pkg_add tor torsocks irssi
$ doas rcctl enable tor
$ doas rcctl start
$ torsocks irssi

/set real_name <realname>
/set user_name <username>
/set nick <nick>
/set ctcp_userinfo_reply mIRC 7.61
/set ctcp_version_reply mIRC 7.61
/set autolog on
/save

You can use something besides mIRC 7.61 for the ctcp reply. Just pick something realistic looking besides irssi.

In order to infiltrate a criminal network, you will need to do some research. Figure out what they are interested in (ddos attacks, phishing, credit card fraud, spamming). Try to understand what language they speak, what they are passionate about, and see if you can strike up a conversation with them. This helps build trust so they will be willing to share more information.

Use a little creativity. Don't commit any illegal crime, don't suggest they commit any crimes. However, feel free to chat with them, ask them how they are doing, what hobbies they enjoy etc. Try to ask them for information to learn more about them, but...be subtle, be subtle! I recommend you avoid lying. However, you are welcome to change your persona. Use a new dialect. If you normally chat using formal English, use lots of slang. Talk like someone their age. Spell things wrong on purpose if it helps you fit in. Go ahead and use bad grammar if it helps. Feel free to use Google translate for the conversation. Have fun!

First, make sure you have proof they have committed a real crime. If there is no evidence, then stop collecting logs. If there is proof, then collect as much data as you can. Make sure you have logging turned on. Figure out what networks they join, what software they use, what servers are their hubs. Data you want to collect:

Real legal name
Age, date of birth, phone number, home address, social media accounts
Business, education background, what software they use (irc daemons, irc clients, irc bots)
What crime networks they collect to. IP addresses, domain names
Their criminal friends
Source code of the software they use

Document everything.

Your biggest tool is your brain. Look for clues. For example, use /list to figure out what are the channels inside the network. Join some of them and see who is around. Are there any bots? What are their IP addresses? Who hosts them? Type /who #channel to list all the users within a channel. Type /names to see all the users in a channel. Type /whois username to get more info about a user. However, be careful, as some ircds may notify the admin when a user runs the /whois command. It helps to hang around in a channel for a few weeks.

For example, suppose you found the IP 1.2.3.4 is hosting an IRC command and control botnet for crime. You can run:

$ whois 1.2.3.4
VPS Hosting Generic VPS-INC (NET-1.2.3.4) 1.2.3.0 - 1.2.6.0

This tells you that the server is hosted with Generic VPS, inc. So, head over to Generic VPS's website and go to their abuse page and contact them. Send them an email to support@ or abuse@example.com, call their phone, chat with them on live chat, fill out a support ticket. Do whatever it takes to let them know that their customer is using the VPS for illegal purposes and needs to be shut down.

Suppose you realize that the domain example.com is being used for the illegal botnet:

$ whois example.com
Domain Name: EXAMPLE.COM
Registry Domain ID: D1234567890
Registrar WHOIS Server:
Registrar URL: http://www.genericregistrarexample.com
Updated Date: 2020-05-06T00:41:36Z
Creation Date: 2018-04-15T05:08:12Z
Registry Expiry Date: 2021-04-15T05:08:12Z
Registrar Registration Expiration Date:
Registrar: Generic Registrar Ltd
Registrar IANA ID: 12345678
Registrar Abuse Contact Email: feedback@genericregistrarexample.com
Registrar Abuse Contact Phone: +1234567890
Reseller:
Domain Status: ok https://icann.org/epp#ok
Domain Status: autoRenewPeriod https://icann.org/epp#autoRenewPeriod
Registrant Organization: Hacker Inc
Registrant State/Province: CA
Registrant Country: US
Name Server: NS1.EXAMPLE.COM
Name Server: NS2.EXAMPLE.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form https://www.icann.org/wicf/)
>>> Last update of WHOIS database: 2020-05-07T13:23:58Z <<<

This tells us that the domain example.com was registered by Hacker Inc with the registrar http://www.genericregistrarexample.com, and that abuse should be reported to feedback@genericregistrarexample.com. So, go to that website, file an abuse report, send them an email, go on live chat with them, make a phone call -- do whatever it takes to get their attention to take the server offline. In one particular case, I had to email the registrar 6 times, filed 6 tickets, made 3 phone calls, and went on live chat twice. It took me over two weeks. But finally the domain got suspended.

Suppose you see one of the criminals joining like this:

14:25 -!- hacker [thief@shell.example.com] has joined #illegal

Based on his vhost mask, you can tell that he's connecting from shell.example.com . Use a browser with Javascript turned off (perhaps using noscript or umatrix) and visit the site on your web browser. You find out that this is a free shell hosting provider. So contact that shell provider's email, phone, and IRC until he closes the account. Make sure you notify him of the ident (in this case thief) and not just the nick (hacker). The ident is the word that comes right before the @ sign. If the shell provider doesn't respond, then you can do this:

$ dig shell.example.com
; <<>> DiG 9.4.2-P2 <<>> shell.example.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39025
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;shell.example.com.       IN      A

;; ANSWER SECTION:
shell.example.com. 300    IN      A       192.168.0.1

;; Query time: 295 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu May  7 22:01:41 2020
;; MSG SIZE  rcvd: 57

This tells you that the IP address for the server is 192.168.0.1. So you then run:

$ whois 192.168.0.1
OrgName:        Cloud
OrgId:          CLD
Address:        123 Nowhere St
City:           Nowhere
StateProv:      NY
PostalCode:     12345
Country:        US
RegDate:        2008-04-24
Updated:        2019-06-28
Comment:        http://www.completelyrandomcloudexample.com
Ref:            https://rdap.arin.net/registry/entity/LINOD
OrgNOCHandle: LN1234567-ARIN
OrgNOCName:   Cloud Network Operations
OrgNOCPhone:  +1-234-567-8900
OrgNOCEmail:  support@completelyrandomcloudexample.com
OrgNOCRef:    https://rdap.arin.net/registry/entity/LN1234567-ARIN

OrgAbuseHandle: LAS1234567-ARIN 
OrgAbuseName:   Cloud Abuse Support
OrgAbusePhone:  +1-234-567-8900
OrgAbuseEmail:  abuse@completelyrandomcloudexample.com
OrgAbuseRef:    https://rdap.arin.net/registry/entity/LAS12-ARIN

OrgTechHandle: LNO1234567-ARIN
OrgTechName:   Cloud Network Operations
OrgTechPhone:  +1-234-567-8900
OrgTechEmail:  support@completelyrandomcloudexample.com
OrgTechRef:    https://rdap.arin.net/registry/entity/LNO21-ARIN

This shell provider uses a Cloud VPS. So, contact Cloud's abuse and support email, phone number, and go to their IRC channel. I spent about two hours chatting over IRC and sent around 4 emails. Do what it takes to make sure Cloud and the shell provider close the guilty accounts.

Sometimes you have an IP but you don't know who owns it. You can run this:

$ dig -x 192.168.0.1
; <<>> DiG 9.4.2-P2 <<>> -x 192.168.0.1
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6039
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.168.192.in-addr.arpa.     IN      PTR

;; ANSWER SECTION:
1.0.168.192.in-addr.arpa. 86400 IN     PTR     criminal.example.com.

;; Query time: 4943 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu May  7 22:05:55 2020
;; MSG SIZE  rcvd: 80

This tells you that the domain name is criminal.example.com.

Once you get this basic information, use a search engine to gather more. Search their name, their network, their websites -- look for any software they might have written, anything about them that might be useful. Their nicknames might show up on old logs, they might have malware associated. This research is very important for proving someone is guilty of a crime.

In your email, make sure to document the crime clearly and provide clear evidence. Use screenshots, videos, chat logs, whatever is most effective.

Make sure that any screenshots or videos you send do not contain any of your personal information! Double check for your own safety. If you want, you can first email to abuse@ircnow.org so our team can take a look.

When you start filing reports, make sure you go in this order:

Take down domains
Take down irc servers
Take down shell accounts / bouncers used by admins/criminals
Finally, take down stolen servers and bots used for stealing

There are reasons why we must follow this order. Many times, when you report abuse, the providers won't trust your logs and will want to verify the crime in person. If you take down the bots and IRC servers before the admin can log in, he will be unable to see any evidence and he may think you are lying. Therefore, you want to preserve as much evidence as possible until the last moment.

The reason we take down domains first is because it causes the most disruption while still allowing you to connect to the IRCd for further spying. Afterwards, we can cause netsplits by taking down the IRC servers, and then take down his shell accounts / bouncers to cause confusion. We save bots and stolen servers for last because this is your evidence. Once you take these down, you will be unable to do anything else.