An 18-year-old accused of years of swatting attacks and threats against a Pennsylvania girl allegedly used an online messaging account accessed through virtual private networks (VPNs).
However, FBI investigators say a phone number, matching internet protocol (IP) addresses and cellular location records helped link the threatening account to the suspect.
Brandon Kapfhammer, also known as Brandon Hiser, is accused of targeting the girl and her family after meeting her online in 2023.
Their Delaware County home became the target of more than 30 false emergency calls, according to police reports reviewed by the FBI. The family also experienced repeated attacks on their property.
A federal criminal complaint filed on 10 July 2026 details how investigators linked the account to Kapfhammer. The document identifies the messaging service only as 'PLATFORM A', although IBTimes Singapore reported that it was Discord.
Years of Swatting Calls and Threats Against a Young Girl
According to the FBI affidavit, the girl met Kapfhammer through an online network called 'The Com' in 2023. She was approximately 12, while he was 15. They initially became friends before starting an online relationship.
Investigators allege that Kapfhammer coerced her into providing explicit photographs and committing acts of self-harm. He allegedly threatened to send armed police to her home or damage the property if she refused his demands.
The girl estimated that her home had been swatted at least 20 times.
Police reports reviewed by the FBI documented more than 30 false emergency calls concerning the residence. Other calls reportedly targeted neighbouring schools using her name. The affidavit also describes at least three incidents involving bricks thrown through windows.
On 21 August 2024, a brick smashed a television inside the home.
Investigators alleged that Kapfhammer paid another individual to carry out the attack, citing interviews in which witnesses described his reported admission.
Brother's Car Set on Fire as Threats Escalated
On 10 May 2026, the girl's brother's car was set on fire in the family's driveway. Video provided to investigators showed two people approaching the vehicle. One smashed a window and threw an object inside before flames spread.
An investigator from the Bureau of Alcohol, Tobacco, Firearms and Explosives classified the blaze as incendiary. However, the complaint does not establish that Kapfhammer personally carried out or commissioned the vehicle attack.
Investigators later obtained screenshots of messages allegedly sent by Kapfhammer through an account using the name 'bdog' on 26 May. The messages threatened further swatting incidents and another possible fire-related attack.
An FBI agent interpreted a reference to a 'moli' as a threat involving a Molotov cocktail.
Another message suggested the sender intended to delete the account to avoid imprisonment if someone died in a fire. Kapfhammer had turned 18 in March 2026.
Phone Number and IP Records Helped FBI Trace Account
Although account records showed numerous VPN connections, investigators identified a significant lead: a Verizon mobile number ending in 8327, which was used to register the account.
The same number appeared in an earlier complaint to the FBI from another woman. She alleged that Kapfhammer had repeatedly swatted her home and used the number to contact her family.
Investigators compared the messaging account's login history with Verizon records.
Several IP addresses used to access the account matched those assigned to the device associated with the telephone number at closely corresponding times.
According to the affidavit, the overlaps suggested that the messaging account and mobile number were operated by the same person. Other connections used VPN services, which can conceal a user's usual IP address.
The matching records provided important evidence but did not independently establish who operated the account.
Cellular Records and Discarded Packaging Added Evidence
Verizon records provided further investigative leads.
Cellular location data placed the device associated with the telephone number in areas of Louisville, Kentucky, where investigators believed Kapfhammer had been staying.
Apple records also linked the number to an iCloud account registered under 'Brandon Withers', matching the subscriber name listed by Verizon. Investigators examined additional internet connections associated with the Apple account.
On 2 July 2026, FBI agents conducting surveillance at a Louisville residence recovered discarded food packaging bearing the name 'Brandon W.'. The label was consistent with the subscriber details in the digital records, although it did not independently identify who operated the messaging account.
Investigators considered these findings alongside the matching IP addresses, telephone records and cellular location information. Together, they formed part of the FBI's probable-cause case.
The investigation illustrates how account registration details and connections made outside a VPN can provide investigative leads, even when other online activity uses privacy services.
FBI Warned About Violence Linked to 'The Com'
The allegations come amid broader concerns about 'The Com', the online network where the two teenagers reportedly met.
In a public warning issued on 23 July 2025, the FBI described an international online network involving minors and young adults. The bureau linked criminal activity within the network to cybercrime, extortion, swatting and physical violence.
The agency warned that individuals involved in the network had developed increasingly sophisticated methods to conceal their identities and financial activity. It also highlighted the recruitment of young people through social media and gaming platforms.
The July 2026 complaint alleges federal cyberstalking and transmitting interstate threats. It was filed in support of an arrest warrant application, not as a determination of guilt. The alleged conduct began in 2023, although the complaint covers alleged offences from around 2024 through 26 May 2026.
Kapfhammer is presumed innocent unless proven guilty.
