Tracing a darknet lead on IoTeX starts with the address you were handed. Convert it to the 0x form first, because the check reads only that form. Then pick the network explicitly.
Reading the outflow
The free check shows the IOTX balance in USD and counts outgoing transactions. That makes it a good first read on where funds left from. Inbound transfers do not appear in the count, so follow the incoming side in the public record.
Keeping the trace usable
Write each hop in 0x form beside the original string. Native and 0x strings can name one account, so a trace that mixes them splits one actor in two. IoTeX blocks finalize quickly, which makes the timeline of a hop easy to pin down.