Teen Used VPN But His Own Phone Number Helped Trace Years of Swatting Attacks: FBI
An 18-year-old accused of years of swatting attacks and firebombing threats allegedly used VPN connections to hide his online activity. Still, FBI investigators say the Discord account used to threaten a girl’s family was registered to a phone number linked to him.
The federal complaint says Brandon Kapfhammer, also known as Brandon Hiser, targeted a minor and her family and continued the alleged conduct after turning 18.
FBI Says Swatting Campaign Lasted for Years
According to the FBI affidavit, the victims’ Delaware County, Pennsylvania, residence had been targeted by more than 30 false emergency calls since about 2023. The girl estimated her home had been swatted at least 20 times, while investigators also found evidence of at least three brick attacks.
The affidavit says Kapfhammer met the girl online when she was about 12 and he was 15. Investigators allege he threatened to swat and brick her home if she did not comply with demands, and that he eventually directed a brick attack by paying another person to carry it out.
The alleged attacks later escalated. On May 10, the victim’s brother’s car was firebombed in the family’s driveway. Investigators said video showed two people approaching the vehicle, breaking its rear window and throwing an object inside before flames spread as they fled. An ATF investigator classified the fire as incendiary.
Discord Threat Allegedly Promised Another Firebombing
Two weeks later, investigators say Kapfhammer used the online name “bdog” to threaten another attack. In a May 26 conversation, he allegedly wrote:
…when the moli comes thru ur window this time n has ur whole house on fire jus remember you basically asked for it
He also allegedly wrote that he would delete the account “so I dont rot in prison” if someone in the family died in a fire. The FBI interpreted the exchange as a threat to throw a Molotov cocktail into the residence and said it indicated the alleged swatting campaign would continue.
VPN Did Not Stop Investigators From Tracing the Account
The affidavit says Discord records showed the “bdog” account had both cellular and VPN connections. But investigators say the account was registered to a Verizon phone number ending in 8327, and records associated that number with Kapfhammer.
The account also used IP addresses that overlapped with those associated with the phone number.
The FBI further cited cell-site data placing the device associated with the number in Louisville, Kentucky, where investigators say Kapfhammer was believed to reside. The affidavit concludes there was probable cause to believe he committed federal stalking and interstate-threat offenses.
