Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts. Method and limits
All 831 posts had different complete texts. Yet every one contained wording about in-person activity, four or five bank relationships and a fixed daily-payment promise. A strict duplicate-text check would have removed none of them.
That is the result of a new comparison within Brandefense’s saved financial-account records. The posts match one narrow bank-cash-withdrawal wording pattern with a 70,000 amount token. Their complete text varies, while these specific recruitment terms recur.
The distinction changes how this material should be read. Text novelty is not the same as a new offer. In this case, even cleaning up Unicode and whitespace leaves 831 unique complete texts around a shared recruitment pitch.
A Specific Promise Inside A Broad Account Collection
The starting point was the edition’s existing group of 831 matches within 2,448 distinct retained financial-account posts, or 33.9%. We kept that group unchanged. It covers recorded posts from February through July 2026, across 132 recorded source-name strings.
A dated catalogue example makes the pitch concrete. The 23 February post seeks people for in-person cash withdrawals, says four or five bank relationships are enough, and promises TRY 70,000 per day. FR-O035 records that advertisement.
The number is a promised payment to a participant, not an asking price for an account. It is not an observed payment or loss. The account-participation investigation explains why this human role matters; here, we examine how the pitch appears across the saved records.
We Tested The Whole Text, Not Just The Matching Phrase
First, we compared the complete saved text of each matched post. All 831 were distinct. We then applied the edition’s existing normalization and compared the complete texts again. The result stayed at 831.
That second comparison decodes HTML entities, folds compatible Unicode forms, removes combining marks and format-control characters, and standardizes case and whitespace. It leaves numbers, words, punctuation and contact text in place. It does not remove selected fragments to make posts look alike.
| Comparison | Distinct Complete Texts | Records Removed By Exact Deduplication |
|---|---|---|
| Original complete text. | 831 | 0 |
| Complete text after the stated normalization. | 831 | 0 |
The full-text comparison method and results describe the exact scope. The test is conservative: two posts count as identical only when their entire compared text matches.
This result rules out a tempting explanation for the earlier figure. The 831 matches are not simply 831 copies of one identical stored text. A count of unique texts can therefore preserve the entire wording family while seeming to have removed repetition.
The Shared Terms Survive The Differences
We next read five complete examples, selected by a fixed hash order rather than editorial preference. They varied in presentation and short ending strings. Some repeated the recruitment block several times within a single post.
Those five examples all retained the same substantive conditions. To avoid assuming this held across the group, we ran three additional phrase checks on all 831 members. Each phrase appeared in every member after the same normalization.
- The wording for fixed daily payment appeared in all 831 posts.
- The wording for active in-person transactions appeared in all 831 posts.
- The wording saying four or five bank relationships were sufficient appeared in all 831 posts.
These checks describe recurring text, not confirmed activity. They also do not prove that every condition in every post was identical. They establish a narrower, useful result: the same three recruitment conditions sit inside 831 different complete texts.
The varied endings in the five inspected examples help explain how a shared pitch can coexist with different full texts. We did not establish why those strings were added. We also did not use their removal to merge records or declare a single campaign.
One Repeated Pitch, Many Recorded Placements
The group spans 132 recorded source-name strings. No one string accounts for more than fourteen of the 831 records. This is a distributed pattern across the saved source labels, rather than hundreds of matching records under one label.
That distribution does not tell us who controlled the sources. One person may use multiple names; unrelated people may reuse a pitch. The records also do not measure audience size or whether anyone responded.
The useful observation is the combination: broad placement across recorded names, recurring recruitment conditions, and no exact whole-text duplicates. Each measure describes a different feature of the same material. None is a count of independent suppliers.
The monthly counts show when matching records occur in this archive. They do not show recruitment success or a market trend. Changes in collection coverage and repeated distribution can affect the recorded volume.
What Changes In An Intelligence Queue
An intelligence queue that treats each new complete text as a new proposition would retain all 831 of these records as novel. Exact-text deduplication alone would not change that result. The repeated conditions need a separate place in the analysis.
For this family, the useful distinction is between a new placement of the known pitch and a material change to its terms. A post can matter because it appears in a different observed context. That does not require presenting it as a newly discovered supplier or a new account-use model.
The same distinction keeps two types of evidence available. Record-level detail preserves the recorded source context and post date. Group-level analysis shows which advertised conditions recur. Collapsing either into the other loses information.
Our comparison of phishing service terms applies this reading to another part of the collection. There, source-code purchases, hosted access and later support describe different arrangements, even when the same broad product label appears.
Scope Of The Comparison
This work uses the frozen financial-account selection from the Fraud edition. It adds a full-text comparison and phrase checks; it does not expand the 831-member group or claim to find every repeated advertisement.
The original group requires normalized wording for bank cash withdrawals and a 70,000 number token. The three description checks were specified after the five-example inspection, then applied to every group member. All matched source timestamps carry UTC offsets.
No service was purchased, no participant was contacted and no payment was observed. The conclusion is about the records themselves: all 831 can be textually unique while carrying the same specified recruitment conditions. A count of unique text is therefore the wrong answer to the question of how many distinct propositions this group contains.
