Part II — The Network Revealed: Mapping the full architecture of a domestic employment fraud network.
Where Part I established the existence of the Stateside Strangler network, Part II mapped it. The investigation expanded from initial entity identification to full network architecture — tracing the connections between fake companies, shared assets, operational patterns, and the human infrastructure behind the scheme.
The scope of what was uncovered exceeded initial estimates. The network was not a loose collection of related bad actors — it was a structured operation with clear organizational logic, shared resources, and coordinated activity patterns.
Network analysis revealed multiple layers of entity construction. Front-facing fake employer pages were supported by networks of fake employee profiles that provided organizational credibility. Those fake employees, in turn, were connected to secondary networks of recruiters — some fake, some real professionals whose identities had been borrowed without consent. The entire structure was designed to create circular trust signals: the company had employees, the employees had connections, the recruiter had endorsements.
Shared asset analysis identified common elements across multiple nominally independent entities — repeated logo variations, overlapping address data, consistent posting schedules, and linguistic patterns that tied listings across different company pages to a common authoring source.
Part II also expanded the documented victim profile. The operation targeted multiple professional categories simultaneously, with apparent prioritization of roles with corporate access: finance, IT, HR, and executive support. The pattern was consistent with an operation oriented toward either credential harvesting for account access or candidate placement in positions that would enable downstream fraud.
As Part II removals proceeded, the network demonstrated adaptive behavior — replacing removed entities with new constructions using the same underlying patterns. This adaptation confirmed the existence of active human operators rather than automated infrastructure, and it shaped the approach taken in Part III: disrupting the operational layer, not just the visible entity layer.