Case 04-B · Mirror Merchants

Are these apparently unrelated merchant identities controlled by the same organization?

You are not asked whether it looks true. You are asked what you can defend, on what evidence, at what stated confidence.

• A single organization controls all six merchant identities.

  ACTIVE
  Stated confidence54

• Two unrelated crews reuse the same bulletproof hosting reseller.

  PENDING
  Stated confidence31

• The shell company is a victim, not a participant.

  DISPUTED
  Stated confidence12

• SIGNAL™Why it surfaced: Concept match, not keyword match

  Payment redirection phrasing recurs across 41 messages

  InvestigateAlternative explanationDismiss
• PATTERN™Why it surfaced: Unusual combination across 8,400 events

  Two merchant accounts share a device fingerprint

  InvestigateAlternative explanationDismiss
• PATTERN™Why it surfaced: Time-based regularity

  Domain registrant pattern repeats at 3-day intervals

  InvestigateAlternative explanationDismiss

• E-014 Merchant onboarding packetVERIFIED

  Custody: Intact · Analyst confidence: High · AI confidence recorded separately

• E-017 Wallet consolidation traceVERIFIED

  Custody: Intact · Analyst confidence: Moderate · AI confidence recorded separately

• E-019 Screenshot of chat threadDISPUTED

  Custody: Source unknown · Analyst confidence: Low · AI confidence recorded separately

• E-021 Reposted product imagePENDING

  Custody: Provenance gap · Analyst confidence: Low · AI confidence recorded separately

A clue is not intelligence until you can defend it.

1. D-12 09:40First victim report received (synthetic).
2. D-09 14:02SIGNAL surfaces unfamiliar redirection phrasing.
3. D-06 11:18CARTOGRAPH resolves two identities to one device.
4. D-04 16:55ARCHIVIST flags E-019 — no source of record.
5. D-01 08:30ADVERSARY proposes competing explanation.

Two clusters currently bridge through a single artifact. That bridge is the weakest and most important claim in the case.

IMG-02 and IMG-03 may share provenance. Training simulation — “may” is not a finding.

• THE ANALYST

  You have three facts and one belief. Tell me which is which.

• THE CARTOGRAPHER

  Two clusters touch through a single artifact. That bridge is thin — and it is your case.

• THE SENTINEL

  Traffic is ordinary except for one connection that has no business existing.

• THE ARCHIVIST

  E-019 has no source of record. Until it does, it is not evidence.

• THE ORIGIN SPECIALIST

  These two images may share an origin. May is not a finding.

• THE ADVERSARY

  If I wanted you to believe exactly this, here is what I would have left for you to find.

AI accelerates the investigation. The investigator owns the conclusion.

54%

Moderate · provenance gap unresolved

Confidence moves when corroboration changes, not when you feel more certain.

• What independently corroborates E-019 without relying on the same screenshot?
• Which single entity, if removed, disconnects both clusters?
• Does the device fingerprint predate the first victim report?
• What lawful basis covers the next step you are considering?

One page. Assessment first, confidence stated, alternatives named, provenance gaps disclosed, recommended next step scoped to lawful authority.