Does this count as phishing?
While people classify multiple things as phishing (often almost calling phishing almost anything), I wouldn't consider this as such, since no credentials are stolen. See for instance PhishTank definition:
Phishing is a fraudulent attempt to get you to provide personal information, including but not limited to, account information.
On the other hand, if the link led them to a page where they provided their FBI username and password, then I would count it as phishing.
How could he have derived the street address of the safe house, when usually internet visitors are identified online only by an IP address?
Through the ISP. While there are databases (both free and commercial) that geolocate IP addresses, they don't work with such precision as to identify an IP address as a given residential house.
The ISP will be assigning IP addresses to the customers (either quite statically, or potentially a new one each time they reboot they router), and only the ISP would know to which address they are assigned a given IP address at a certain time. This should in principle only be disclosed through a subpoena, although it would be possible for Elliot to have access to that if:
- Elliot himself worked for the ISP and had access to such data
- Elliot obtained that data from someone which had (legitimately or illegally) access to it (e.g. through bribery, blackmailing…)
- Elliot has compromised the database where the ISP stores such data
Other ways to obtain the address not involving the ISP would include:
The page used the geolocation API to query the browser where it is and
- somehow the feds granted the browser permission to disclose it
- the browser itself has an accurate notion of its position, such as a smartphone with a GPS receiver
they provided the address to another service, and Elliot was able to fetch that from the other service.
For example: they previously bought pizzas from that connection, and provided their physical address for delivery. Elliot was able to look up (he compromised the pizza company?) that someone from that IP address requested a pizza to a given location 3 hours ago and concluded that the person currently using that same IP address is at that address.