15,008 unlabeled signups. 251 likely multi-account actors.
A merchant handed over a snapshot with no labels — nobody said who was abusive, or whether abuse existed at all. We linked accounts only when a strong identity signal, or two weaker ones, said they were the same person. Legitimate customers stay out of the graph.
- 15,008signups in the snapshot
- keysevery field collapsed to an identity
- 470pairs that cleared the gate
- 251clusters / 587 linked accounts
Three cases worth opening
Start here instead of the full graph. Each card is a real cluster from this run.
Nine accounts, one inbox
Nine signups reach jamiejackson@gmail.com. One of them also shares a device hash. This is a classic alias ring — the kind of case we would put in front of a merchant.
Same house, three spellings
Tammy, Roger, and Michael Cabrera look like different people in the email field. They share a device, and they live at 803 Anderson Drive — typed once as ANDEESON. Address never links a pair by itself; here it only corroborates the device.
Same card, two devices
Card 453245 ending 5529 shows up at 8089 Gonzalez Ave. A nearby cluster (C00236) has the same card and street, Suite vs STE, and a different device. We did not glue them into one actor.
What actually linked them
Most CERTAIN clusters are Gmail alias rings. Device hash and card (BIN + last 4) are the interesting minority — rarer, and usually the cases that are not just the same inbox.
Largest rings
View all 251 in explorer →Sorted by size among CERTAIN, then HIGH. That is not the same as link weight — a two-account Gmail alias can score higher than a nine-account ring.