Every request an analyst sends to a phishing page or criminal forum carries an IP address. If that address traces back to a ...