proactively attempting to evade one's own detection systems to identify vulnerabilities 4. **Network-level analysis** that detects coordination regardless of individual account sophistication 5. **Infrastructure analysis** (IP ranges, hosting providers, payment methods) that detects operations at th