[smokenn]

Thanks for the tip! I appreciate it!

But this guy is pretty clever.
He's using proton mail ..@pm.me (paid version) for email communication. And proton mail hides any information about the real person sending the email. Even changes the GMT zone, so timestamp extracted wouldn't be very helpful. All the IP addresses direct to protonmail.ch/protonmail.com servers.
Before PM.ME, he was using GMX mail, and before that: Gmail, and Gmail allowed me to attempt to login to his account, and see his recovery options, but that wasn't very helpful because all I could see were parts of his recovery email or cell-phone number. Same goes for paypal: he used those same GMX/Google to register for PayPal account, so again I could see parts of his recovery emails or cell-phone numbers.

I even attempted a basic phishing process, built a temp. website asking him if he plans on getting the product from that website (my website), so he'll have to visit the page in order to see what I'm talking about, however the IP I hooked after he visited it appears to be a VPN IP: 185.212.171.203 (when I visit this IP, I get info about it being NordVPN), so I know he's trying to be extra safe, which makes all of this even more difficult for a beginner like me.

He does own several social media profiles. But he's using fake names on each of his profile, and fake profile images (for example: CEO of one of the bus companies in Spain). And all he does on his social media profiles is advertising his website. Do you feel like finding who this guy is would be easier through social media profiles?