{
  "version": "1.0",
  "built_date": "2026-10-29",
  "title": "Inside the Fraud Service Economy",
  "creator": "Brandefense Research Team",
  "source": "Brandefense Blackhole",
  "period": {
    "start": "2026-01-01",
    "end": "2026-10-27",
    "timezone": "as_recorded",
    "query_window_timezone": "UTC",
    "partial_month": "2026-10",
    "label": "1 January–27 October 2026",
    "date_field": "post.created_at",
    "date_semantics": "Recorded source post dates; some timestamps lack offsets; aggregates use saved date prefixes. All 831 template-match timestamps carry Z (UTC)."
  },
  "summary": {
    "fetched_rows": 26925,
    "distinct_fetched_post_ids": 26718,
    "retained_row_occurrences": 11663,
    "retained_set_memberships": 11558,
    "distinct_retained_post_ids": 11540,
    "overlap_excess_memberships": 18,
    "template_records": 831,
    "template_denominator": 2448,
    "template_share_pct": 33.9,
    "template_source_channel_names": 132,
    "kit_fetched_rows": 435,
    "kit_counted_results": 448,
    "kit_retained_post_ids": 147,
    "kit_long_raw_texts": 40,
    "full_mismatch_windows": 11
  },
  "sets": [
    {
      "set_id": "c_carding",
      "label": "Carding label",
      "kind": "class",
      "fetched_rows": 4797,
      "distinct_post_ids": 4797,
      "retained_row_occurrences": 1413,
      "retained_post_ids": 1413,
      "sample_windows": 48,
      "full_windows": 0,
      "empty_count_windows": 0,
      "full_mismatch_windows": 0,
      "reported_query_results": 2236991
    },
    {
      "set_id": "c_fin_account",
      "label": "Financial account label",
      "kind": "class",
      "fetched_rows": 4778,
      "distinct_post_ids": 4778,
      "retained_row_occurrences": 2448,
      "retained_post_ids": 2448,
      "sample_windows": 48,
      "full_windows": 0,
      "empty_count_windows": 0,
      "full_mismatch_windows": 0,
      "reported_query_results": 4614996
    },
    {
      "set_id": "c_fin_fraud",
      "label": "Financial fraud label",
      "kind": "class",
      "fetched_rows": 3936,
      "distinct_post_ids": 3936,
      "retained_row_occurrences": 752,
      "retained_post_ids": 752,
      "sample_windows": 26,
      "full_windows": 22,
      "empty_count_windows": 0,
      "full_mismatch_windows": 1,
      "reported_query_results": 397193
    },
    {
      "set_id": "c_fraud_source",
      "label": "Fraud source-code label",
      "kind": "class",
      "fetched_rows": 2247,
      "distinct_post_ids": 2247,
      "retained_row_occurrences": 1493,
      "retained_post_ids": 1493,
      "sample_windows": 23,
      "full_windows": 4,
      "empty_count_windows": 21,
      "full_mismatch_windows": 0,
      "reported_query_results": 61317
    },
    {
      "set_id": "c_phishing",
      "label": "Phishing label",
      "kind": "class",
      "fetched_rows": 4679,
      "distinct_post_ids": 4679,
      "retained_row_occurrences": 875,
      "retained_post_ids": 875,
      "sample_windows": 48,
      "full_windows": 0,
      "empty_count_windows": 0,
      "full_mismatch_windows": 0,
      "reported_query_results": 3379914
    },
    {
      "set_id": "k_fullz",
      "label": "Fullz keyword",
      "kind": "keyword",
      "fetched_rows": 6053,
      "distinct_post_ids": 5903,
      "retained_row_occurrences": 4535,
      "retained_post_ids": 4430,
      "sample_windows": 40,
      "full_windows": 8,
      "empty_count_windows": 0,
      "full_mismatch_windows": 1,
      "reported_query_results": 30967
    },
    {
      "set_id": "k_phishing_kit",
      "label": "Phishing kit keyword",
      "kind": "keyword",
      "fetched_rows": 435,
      "distinct_post_ids": 435,
      "retained_row_occurrences": 147,
      "retained_post_ids": 147,
      "sample_windows": 0,
      "full_windows": 48,
      "empty_count_windows": 0,
      "full_mismatch_windows": 9,
      "reported_query_results": 448
    }
  ],
  "template_monthly": [
    {
      "month": "2026-02",
      "records": 55
    },
    {
      "month": "2026-03",
      "records": 243
    },
    {
      "month": "2026-04",
      "records": 196
    },
    {
      "month": "2026-05",
      "records": 212
    },
    {
      "month": "2026-06",
      "records": 120
    },
    {
      "month": "2026-07",
      "records": 5
    }
  ],
  "limitations": [
    "These are observed records in seven saved Blackhole queries, not a census of fraud, completed transactions, victims, sellers or market size.",
    "The retained layer preserves a frozen automated selection. Its broad topic filters admit mixed intent, mislabels and repeated advertising. Retention is not verification of an offer.",
    "Larger query windows used sampled result pages. Small windows were labelled full, but 11 full-labelled windows returned fewer rows than their saved result count. No completeness claim is made.",
    "The seven queries overlap. Row occurrences, distinct post IDs and retained set memberships are separate units. Retained category totals must not be added as unique offers.",
    "Classifier labels changed around May–July 2026. October ends on 27 October. No annual growth, market share, volume extrapolation or price index is published.",
    "The repeated cash-withdrawal text is a narrow lexical family. Shared wording and source channel names do not establish a common actor, campaign or unique offer.",
    "Dates use recorded post.created_at values, not first Brandefense observation. Some timestamps lack offsets; aggregates use recorded date prefixes. The query windows used UTC bounds. No general early-warning lead time, prevented loss or realized transaction value is established.",
    "The saved collection is dominated by Telegram with limited forum coverage; it does not represent Tor marketplaces, closed communities or the wider underground.",
    "The former weighted estimates and confidence intervals are excluded. No population estimate or sampling confidence interval is calculated for this release.",
    "Public offer examples are selected from raw full text and separately catalogued. Asking prices, balances, promised payouts and service effectiveness are different concepts; none demonstrates delivery.",
    "Personal data, source names, handles, raw post IDs, illicit links and raw text remain local. Brandefense analysts approved the findings."
  ],
  "findings": [
    {
      "id": "observed",
      "title": "11,540 retained records; no claim of 11,540 offers.",
      "text": "Seven saved queries contain 26,925 fetched row occurrences. Their frozen filters retain 11,540 distinct post IDs across 11,558 set memberships.",
      "evidence": "observed-records.csv and counting-units.csv",
      "limit": "Labels overlap and retained text has mixed intent; this is not market size."
    },
    {
      "id": "repetition",
      "title": "Repeated wording can dominate a filtered view.",
      "text": "831 of 2,448 retained financial-account records (33.9%) match one cash-withdrawal wording pattern, across 132 source channel names from February to July.",
      "evidence": "template-monthly.csv; full-text lexical predicate in methodology.html",
      "limit": "This does not mean 831 separate offers or 132 sellers."
    },
    {
      "id": "fulltext",
      "title": "Full text changes what can be checked.",
      "text": "40 of 147 retained phishing-kit records were cut at 1,500 characters in the earlier analysis file. Their raw originals are longer; this edition reads the originals.",
      "evidence": "Raw-versus-clean length comparison, frozen in build evidence.",
      "limit": "The 147 records are a query-retained set, not 147 confirmed kits."
    },
    {
      "id": "sampling",
      "title": "A full-fetch label does not guarantee complete retrieval.",
      "text": "The phishing-kit query saved 448 counted results but 435 fetched records. Nine full-labelled windows have a count mismatch.",
      "evidence": "retrieval-windows.csv",
      "limit": "The reason for the mismatch is not established from the saved files."
    }
  ],
  "assets": {
    "manifest": "fraud-data.json",
    "sets_csv": "observed-records.csv",
    "windows_csv": "retrieval-windows.csv",
    "template_csv": "template-monthly.csv",
    "unit_csv": "counting-units.csv",
    "methodology": "methodology.html",
    "dictionary": "data-dictionary.html",
    "press": "press-kit.html",
    "license": "license.html",
    "charts": [
      {
        "id": "observed-records",
        "title": "Seven query sets, one observed-record boundary",
        "svg": "chart-observed-records.svg",
        "png": "chart-observed-records.png",
        "alt": "Distinct retained post IDs by query: fullz 4430, financial accounts 2448, fraud source code 1493, carding 1413, phishing 875, financial fraud 752, phishing kit 147. Categories overlap and are not verified offers."
      },
      {
        "id": "template-repetition",
        "title": "One wording pattern survives the filter 831 times",
        "svg": "chart-template-repetition.svg",
        "png": "chart-template-repetition.png",
        "alt": "831 of 2448 retained financial-account post IDs match the cash-withdrawal text pattern, 33.9 percent, across 132 source channel names in February through July. This is text repetition, not actor attribution."
      },
      {
        "id": "sampling-boundaries",
        "title": "Counts change when the unit changes",
        "svg": "chart-sampling-boundaries.svg",
        "png": "chart-sampling-boundaries.png",
        "alt": "26925 fetched row occurrences become 26718 distinct post IDs. Frozen selection retains 11558 set memberships representing 11540 post IDs. This is a sampled observation, not a market total."
      }
    ],
    "social": {
      "overview": "social-overview.png",
      "repetition": "social-repetition.png",
      "method": "social-counting.png",
      "cover": "social-cover.png"
    },
    "catalogue_csv": "offer-catalog.csv",
    "catalogue_json": "offer-catalog.json",
    "catalogue_method": "offer-catalog-method.md",
    "catalogue_findings": "offer-catalog-findings.md",
    "price_terms_csv": "offer-price-terms.csv",
    "catalogue_review_scope": "offer-review-summary.json",
    "catalogue_validation": "offer-validation.json",
    "catalogue_html": "offer-catalog.html",
    "pdf": "fraud-report-2026.pdf",
    "reader": "fraud-report-2026.html",
    "cover": "fraud-report-cover.png",
    "carding_evidence": "carding-evidence.html",
    "phishing_methods_evidence": "phishing-methods-evidence.html",
    "repetition_text_comparison": "repetition-text-comparison.json",
    "repetition_text_comparison_method": "repetition-text-comparison-method.html",
    "repetition_text_comparison_csv": "repetition-text-comparison.csv"
  },
  "ai_disclosure": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts. Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.",
  "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.",
  "attribution": "Source: Brandefense Research Team, Inside the Fraud Service Economy, 2026, v1.0. Data: Brandefense Blackhole, 1 Jan–27 Oct 2026. Observed records, not market totals."
}