THE KILLER NEVER LOGGED OUT CLUES

The killer connected to the public network outside the top-of-the-hour system backup window. Eliminate every row where the timestamp minute value is 00, 01, 02, 03, 04, or 05.

The Hexadecimal Outlier: The killer used a cloned device. Count the letters in the MAC address. Only letters A, B, C, D, E, and F count. The killer’s MAC address contains exactly four letters across the full 12-character hardware string. Eliminate all rows with fewer or more than four letters.

The Even/Odd IP Paradox: The killer routed traffic through a proxy that fails on an even final octet. Look at the final number block of the IP address. The killer’s final IP block is odd. Eliminate every row with an even final IP block.

The Location Code Redundancy Rule: The killer avoided public Wi-Fi routers with repeating digits in their Location ID. Look only at the four digits after LOC-. Eliminate every row where any digit repeats. Example: LOC-4812 survives. LOC-4412 is eliminated.

The Bandwidth Cap: The killer transferred enough data to upload compressed audio files, but not enough to trigger a bulk-transfer alert. The Data Transferred value must be strictly greater than 150.0 MB and strictly less than 450.0 MB. Eliminate all rows with data values 150.0 MB or lower and 450.0 MB or higher.

The Odd Country Node: The killer used a VPN node based in a country whose name contains an odd number of letters. Count only alphabetic letters. Ignore spaces, hyphens, and punctuation. Eliminate every row where the VPN country name has an even number of letters.

The Port Divisibility Test: The VPN server port used by the killer is a mathematical multiple of 3. Eliminate every row where the port number cannot be divided evenly by 3.

The Police Sweep Cutoff: The killer disconnected before the police precinct began its morning digital sweep at exactly 05:30:00 AM. Eliminate every row with a disconnect time of 05:30:00 AM or later.

The Even Decimal Overhead: The VPN encryption overhead leaves a decimal ending in an even digit. Look at the final digit after the decimal point in the Overhead value. It must end in 2, 4, 6, or 8. Eliminate all rows ending in an odd decimal digit or zero.

The Badge Prime Rule: The killer used a stolen janitorial or contractor badge. The Badge ID must begin with a prime digit. Valid starting digits are 2, 3, 5, or 7. Eliminate every row where the Badge ID begins with any other digit.

The Facility Mismatch Rule: The killer avoided entering a facility building number that matched the first digit of the surviving Wi-Fi Location ID from Day 1. Compare the first digit after LOC- from the surviving Grid 1 row to the facility building number in Grid 3. Eliminate any row where those two values match.

The Pre-Connection Window: The building entry swipe happened before the public Wi-Fi connection. The swipe timestamp must occur at least 15 minutes before the Wi-Fi connection time and no more than 45 minutes before it. Eliminate every row outside that time window.

The Disposable Voucher Price: The killer purchased a disposable network voucher using a digital wallet. The transaction amount must end exactly in .99. Eliminate every row with any other cents value.

The Zero-Free Terminal: The merchant terminal identification number contains no zeroes. Eliminate every row where the terminal code contains the digit 0 anywhere in the string.

The Token Ratio Test: The digital authorization token contains more letters than numbers. Count only alphabetic letters and numeric digits. Eliminate every row where the number count is equal to or greater than the letter count.

The RSSI Signal Rule: The killer’s burner phone registered a signal strength value that is strictly negative and even. The RSSI value must be a negative even integer, such as -64 dBm, -68 dBm, or -72 dBm. Eliminate every row that is positive, odd, or non-integer.

The LOGGED Sector Rule: The antenna sector code must end in a letter that appears in the word LOGGED. Valid sector letters are L, O, G, E, and D. Eliminate all rows with sector letters not found in LOGGED.

The Master Link: Cross-reference the final survivors across all five grids. The true perpetrator is the single remaining row where the final surviving IP Address from Grid 1 matches the exact hidden encryption gateway sequence listed in Grid 5. The match must be exact, including every number and dot. When one IP address matches one gateway sequence, the case is solved.