Personal data of victims is collected through registration forms on fake investment platforms, and the actor tracks user information while preventing revisits from crawlers and security vendors.