The IT Support Merchant With 287 Sending Addresses

The pattern most closely fits a money-mule or scam-proceeds account, not ordinary IT support. The strongest indicators are structural: 412 deposits from 287 addresses, almost all in a narrow 90-300 USDT band; rapid consolidation within minutes; immediate conversion to BTC; and forwarding to a nested service with 38% exposure to a romance-scam cluster. The revenue mismatch, $71k inflows against $18k stated, and the absence of payroll, rent, software, or supplier payments are inconsistent with an operating IT business. A single $3,200 monthly transfer to a personal account suggests extraction rather than business cash flow. The remote opening from a different country and template website weaken the stated business profile. But the case is not closed by typology: legitimate payment processors also receive many small payments and consolidate. What is missing is the commercial explanation: invoices, customer contracts, tickets, refunds, and a link between each deposit and a service delivered. The owner's cooperation and a utility bill do not cure the substantive mismatch.

Disposition should be risk-based and staged. First, preserve account, device, IP, and transaction records, and do not tell the customer the account is under investigation. Second, request enhanced due diligence: beneficial ownership, business registration, tax filings, bank statements, website analytics, customer list, invoices, and an explanation of why payments arrive in USDT from many unrelated addresses. Test a sample of deposits: do the sending addresses appear in scam complaints or victim reports? Do the amounts match invoices? Third, consider a temporary restriction on outbound transfers while the review is open, especially because funds are being converted and moved quickly. If the customer cannot substantiate the business, or if the blockchain exposure is corroborated, file a suspicious transaction report and consider exiting the relationship. If the explanation is credible, document why and set enhanced monitoring. The key is to avoid both premature closure and indefinite freezing without documented reasoning.

Corroboration would require independent records that match the on-chain flow: invoices issued before payment, each tied to a deposit amount, date, and sending address; a ticketing or remote-support system showing sessions delivered; contracts or statements of work with named customers; and bank or accounting records showing the USDT was recognized as revenue. The investigator should compare the pattern of small payments to the business's pricing. Rebuttal evidence would include invoices created after the inquiry, generic or recycled documents, no customer contact details, deposits that do not map to any ticket, or a buyer network that overlaps with known scam victims. The 287 sending addresses are particularly important: if they are fresh wallets with no other activity, or if they match addresses in victim reports, the tech support story is undermined. Conversely, if the addresses belong to repeat business customers and the amounts reconcile to invoices, the alert may be a false positive. The decision should rest on reconciliation, not on the owner's explanation alone.