& CHILOREN CyberTipline Report 83658616 Priority Level: 3 (Additional information required to determine possible risk) Received by NCMEC on 12-15-2020 23:52:05 UTC All dates are displayed as MM-DD-YYYY Except for times provided in Additional Information sections, all time zones are displayed in UTC - Executive Summary The following is a brief overview of information contained in this CyberTipline report: Incident Type: Child Sex Trafficking rnd pl soe fey ala“ le Nin al all aati lahat aiid inninliieeaimeiainineen bined ibiatinine uploaded files submi by the reporting ESP. The National Center for Missing & Exploited Chiren (NCMEC) was incorporated in 1984 ty cid advocates 2 a private, non. prof ie) cogemencn 90 eatvs 6s national and resource Pe ectnaatas red enforcement, and the public on nc Sia ped red beatin. To Retr ols sti io hele x ang eeu radios child sexual exploitation, and prevent victimization, NCMEC operates the C: ipline and Child Ider Program. NCMEC makes information submitted to the CyberTipline and Child Victim tion ee also uses this information to help identify trends and create child and a se, NCMEC also works with Electronic Service i , law enforcement and the public in a combined | to reduce online child sexual abuse images. NCMEC performs its of work pursuant to its own private mission and ii business . NCMEC does not act in the capacity Selicier ive dieetnon or control at Wie cervervimert or laa? cement agencies. NCM! not and cannot verify the accuracy of the information submi by reporting parties. EFTA00129101

--=PAGE_BREAK=--

mune CyberTipline Report 83658616 | i Section A: Reported Information Reporting Person Incident Information Other 2 2 = | Section B: Automated Information Added by NCMEC Systems Explanation of Automated Information (in alphabetical order) NIN Section C: Additional Information Provided by NCMEC NCMEC Note #1 NCMEC Note #2 NCMEC Note #3 NCMEC Note #4 Supplemental Files OO www iw Section D: Law Enforcement Contact Information _CSTT_FBI (Alexandria) This Report is provided fr informational purposes pursuant to NCMEC's nonprofit mission Please out all information in tus Report os i. EFTA00129102

--=PAGE_BREAK=--

esas CyberTipline Report 83658616 | 1 Section A: Reported Information Incident Type: Child Sex Trafficking Incident Time: 12-15-2020 23:49:00 UTC eeastunaliarar sumanuen aan Linenthuetteeiduatrasdhontdeharnbaetad tonskieedaledate om NCMEC Call Center or Reporting ESP. The information appearing in Section A is received in the original submission. The reporting of information in Section A, other than the "Incident Type” and “Incident Time,” is voluntary and undertaken at the initiative of the Reporting Person or Reporting ESP. This Report is provided solely for informational purposes pursuant to NCMEC's nonprofit mission. Please treat all information in this Report as 7 io NOME EFTA00129103

--=PAGE_BREAK=--

Section B: Automated Information Added by NCMEC Systems CyberTipline Report 83658616 | 2 Upon receipt of a CyberTipline report, NCMEC Systems may conduct automated on the information submitted in Section ‘The information found in Section B of this CyberTipline Report has been generated by NCMEC Systems. If the CyberTipline Report was submitted by a member of the public, Section B will be blank. When a Reporting ESP voluntarily reports an IP address for the "Suspect," NCMEC Systems will geographically resolve the IP address via a publicly-available online query. The results of this lookup are displayed. Geolocation data is approximate and may not display a user's exact location. Please be that the geolocation information provided Sa ft foelng a eaidecantiain nf fenelion bese on achentideth wahauhec provid trtee'apatien GOP. This concludes Section B This Report is provided solely for informational purposes pursuant to NCMEC's nonprofit mission. Please treat all information in this Report as confidential. EFTA00129104

--=PAGE_BREAK=--

MISSING & EXPLOITED CyberTipline Report 83658616 | 3 Section C: Additional Information Provided by NCMEC Section C contains information collected by NCMEC staff based on the information NCMEC Call Center or Reporting ESP. Section C may contain a variety of additional ‘on publicly-available, open-source websites. Any queries conducted by NCMEC staff will saved to the electronic filing system when possible. The CyberTipline cannot confirm NCMEC Priority Level: 3 (Additional information required to NCMEC Classification’: Child Sex Trafficking NCMEC Date Processed: 12-17-2020 21:57:07 UTC Made Available to Law Enforcement by NCMEC: Yes determine possible risk) NCMEC Clnselicatiog Is based on NCMECs review of the report OR a “Hash Matctr’ of one or more uptbaded fles. NCMEC may not have viewed all uploaded files submitted by the CSTT-SEF 12-17-2020 21:35:13 UTC This CyberTipline Report was processed by the Child Sex Trafficking Team (CSTT) in the questions regarding this report, or need any technical assistance pertaining to child sex org. Any open source and/or public record searches conducted by NCMEC will be documented filing system. The NCMEC cannot confirm the accuracy of information found in public any of the parties affiliated with this report. Analysis Division. Should you have any |, Please contact us at in this report and saved to the electronic or whether the results are associated with ete an ede ee nia naatie dnkdae battalion ee deconfliction on relevant terms listed within the narrative, at this time. If you would like within the narrative, please e-mail (EE org with this request. searches on the information listed CSTT-SEF 12-17-2020 21:38:56 UTC At this time | will conduct searches on the reported information. | searched for previous reports known to the Exploited Child Division and other NCMEC Databases (Sex Offender Tracking Team, Missing Children's Database and Attempted Abductions) on the following terms: | did not locate any results at this time. This Report is provided solely for informational purposes pursuant to NOMECS nonprofit mission. Please ial. treat all information in this Report as confiden| EFTA00129105

--=PAGE_BREAK=--

Ah MISSING & EXPLOITEI CyberTipline Report 83658616 | 4 CSTT-SEF 12-17-2020 21:41:09 UTC At this time | will conduct searches on the reporting party. | searched for previous reports known to the Exploited Child Division and other NCMEC Databases (Sex Offender Tracking Team, Missing Children's Database and Attempted Abductions) on the following terms: “Kathryn Dee” | did not locate any results at this time. WHOIS lookup for :WHOIS lookup for JE : IP and Network lookup information: Address lookup canonical name 120 . sub-174-228-8 . myvzw.com . aliases NetName: WIRELESSDATANETWORK NetHandle: NET-174-192-0-0-1 Parent: NET174 (NET-174-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Cellco Partnership DBA Verizon Wireless (CLLC) RegDate: 2008-12-16 Updated: 2012-03-02 Ref: https://rdap.arin.net/registry/ip/174.192.0.0 OrgName: Celico Partnership DBA Verizon Wireless Orgid: CLLC Address: 180 Washington Valley Road City: Bedminster This Report is provided solely for informa’ to NCMEC Please treat ai s confidential. EFTA00129106

--=PAGE_BREAK=--

Ah MISSING & a CyberTipline Report 83658616 | 5 StateProv: NJ PostalCode: 07039 Country: US RegDate: 2001-10-01 Updated: 2017-10-12 OrgAbuseHandle: ABUSE716-ARIN OrgAbuseName: Abuse OrgAbusePhone: +1-908-306-7000 OrgAbuseEmail: abuse@verizonwireless.com OrgAbuseRef: _https://rdap.arin.net/registry/entity/ABUSE716-ARIN OrgTechHandle: NDBM-ARIN OrgTechName: NDBM OrgTechPhone: +1-908-306-7000 OrgTechEmail: VZWNDBMIPControl@VerizonWireless.com OrgTechRef. https://rdap.arin.net/registry/entity/NDBM-ARIN DNS records name class type data time to live 120.sub-174-228-8.myvzw.com IN A EEE) 7200s (02:00:00) sub-174-228-8.myvzw.com IN NS ns1.vzwdomain.com 7200s (02:00:00) sub-174-228-8.myvzw.com IN NS ns2.vzwdomain.com 7200s (02:00:00) sub-174-228-8.myvzw.com IN SOA server: njbbintdnstv.local email: vzw.net.dns@verizonwireless.com serial: 2009012822 refresh: 86400 retry: 7200 expire: 1209600 minimum ttl: 900 7200s (02:00:00) myvzw.com IN NS ns1.vzwdomain.com 7200s (02:00:00) myvzw.com IN NS ns2.vzwdomain.com 7200s (02:00:00) myvzw.com IN A 207.68.174.238 7200s (02:00:00) myvzw.com IN SOA server: njbbintdnsiv.local email: vzw.net.dns@verizonwireless.com serial: 2012104588 refresh: 43200 retry: 7200 expire: 1209600 minimum ttl: 10800 7200s (02:00:00) 120.8.228.174.in-addr.arpa IN PTR 120.sub-174-228-8.myvzw.com 1446s (00:24:06) 228.174.in-addr.arpa IN NS ns2.vzwdomain.com 7200s (02:00:00) 228.174.in-addr.arpa IN NS ns1.vzwdomain.com 7200s (02:00:00) 228.174.in-addr.arpa IN SOA server: njbbintdns‘1v.local email: vzw.net.dns@verizonwireless.com serial: 281 refresh: 86400 retry: 7200 expire: 1209600 minimum ttl: 900 7200s (02:00:00) Traceroute Tracing route to 120.sub-174-228-8.myvzw.com (... hop ort rt rt ip address fully qualified domain name 12141 169.254.158.58 2141 0 169.48.118.156 ae103.ppr01.dal13.networklayer.com 3.000 169.48.118.136 88.76.30a9.ip4.static.sl-reverse.com 4* * 3 169.45.18.88 ae17.cbs01.eq01.dal03.networklayer.com § 1 1 1 50.97.17.53 a@33.bbr01.eq01.dal03.networklayer.com 6141141 64.125.192.21 ae9.er2.dfw2.us.zip.zayo.com 7 114 «41 64.125.27.104 ae24.cs2.dfw2.us.zip.zayo.com eerfe 9 11 «1 64.125.14.253 zayo.vdms.er2.ord7.us.zip.zayo.com orf "mete 12 41 39 40 69.82.18.181 181.sub-69-82-18.myvzw.com 3 fet This Report is provided solely for informational purposes pursuant to NCMEC’s nonprofit mission. Please treat all information in this Report as confidential. EFTA00129107

--=PAGE_BREAK=--

eh HISSING & EXPLOITEL “meee ie + * o eee. Trace aborted Maxmind Geographic Results: Country: US ISP: Verizon Wireless Organization: Verizon Wireless Types: cellular Google Geographic Results: Country: US Latitude: Longitude: Area: 170,554.7969 sq. km. (65,851.5755 sq. miles) il NCMEC Note #4 CSTT-SEF 12-17-2020 21:41:20 UTC The following Point of Contact has been sent a copy of this CyberTipline report: FBI: a Federal Bureau of Investigation Email Des! Cell: cc: FBlinnocenceLost@ic.fbi.gov Questions regarding Innocence Lost and national intelligence may be addressed to Po Supplemental Files The following is a list of supplemental files saved to the report by NCMEC CTT83658616.pdf EFTA00129108

--=PAGE_BREAK=--

sos AR PxpLorte CyberTipline Report 83658616 | 7 This concludes Section C If you need further information regarding the contents of this Report, please contact the Child Sex Trafficking Team at a . This Report is provided solely for informational purposes pursuant to NOMECs nonprofit mission. Please treat all information in this Report as confidenfjal. EFTA00129109

--=PAGE_BREAK=--

MISSING & EXPLOITED CyberTipline Report 83658616 | 8 Section D: Law Enforcement Contact Information ‘The report was made available to the Law Enforcement Agency listed below. Investigator: Assigned Officer: CawiState: Alexai VA Email Kddress: Time/Date was made available: 12-17-2020 21:55:00 UTC This concludes Section D This concludes CyberTipline Report 83658616 This Report is provided solely for informational purposes pursuant to NCMI Please treat all information in this Report as confidential. ‘C's nonprofit mission. EFTA00129110