Skip to main content
← All cases
Public evidence corpus · active investigation

Wiener-Gate

A multi-brand online pet-purchase fraud network, documented as a criminal supply chain rather than a single suspect.

operations active Version 1.0 · August 2026 · point-in-time snapshot
The governing model
This is a supply chain, not a suspect (HANDOFF section 1). Separate vendors sell separate components — templates, aged pages, payment fronts, courier kits — assembled by whoever rents them. That explains why storefronts look identical but share no infrastructure, and why removing one page removes an instance rather than the supply (N-1).

The eight brands

All use one of two framings, breeder or rescue. The rescue framing appears twice because it suppresses price scrutiny (C). The logos share a generator signature: identical brown/cream/dusty-pink palette, script-over-serif lockup, paw prints and hearts. Same template, same hand.

Brand framingBreed focusNotes
"S.M Home Raised Doxies" + variantsDachshundThe original brand that opened the case. Domain no longer registered (R-2). Logo is AI-generated (C-1)
"USA Pets for Home"Five unrelated breeds on one siteBuilt on an AI website generator. Testimonial photographs resolve to a generated-image path (A2-1, A2)
"Royal Paws Companions"Bernedoodle, Dachshund, French Bulldog"America’s #1 Rated Bernedoodle Breeder", "Recognized nationally since 2012" (A4)
"Evergreen Companion Dogs"Dachshund, Poodle, Basset, Chihuahua, GoldenPublishes a Florida address, a Wisconsin messaging number, and a Pennsylvania telephone (U-1, U-2)
"ABKC American Bully Puppies"American BullyCross-linked from the original brand’s footer. Domain no longer registered (A-8, R-2)
"Happy Tail Dachshunds"DachshundFourth brand cluster (A6)
"Dachshund Rescue and Adoption Network"Dachshund · rescue framingAI-generated logo (C-2)
"Bernedoodle Hearts Rescue and Rehoming"Bernedoodle · rescue framingAI-generated logo. A similarly named entity carries a documented consumer-harm trail elsewhere (C-4)

What actually links these sites

Content layer
DOCUMENTED

The durable linkage. "Priya" appears four times across three domains on two hosting stacks, alongside "James" and "Sarah M." (Q-5, S-3, T-3, U-7). The same persona pool reaches into the shipping front’s demo tracking record (T-3). This linkage never depended on infrastructure, so it survives every infrastructure correction.

Infrastructure layer
TESTED & WITHDRAWN

Three domains web-serve from a shared address — but it carries 48+ tenants, the domains use three different nameserver pairs consistent with three separate hosting purchases, and one storefront sits on a different stack entirely (R-4, S-6). The correct framing for any filing is the narrow one.

The social layer

SurfaceWhat is documented
Facebook account clusters38 distinct clusters by media-ID grouping. The largest holds 18 files with IDs spanning a wide range — posting over time, not a bulk dump (K-3)
Page recyclingOne page: created 7 June, renamed same day, dormant ten weeks, renamed to a personal name with a stolen photograph 13 August, soliciting a wire by 25 August. Twelve-day cycle from identity assignment to payment solicitation (N-1, Z-8 — PROVISIONAL)
Group administrationOne captured roster: seven of eight administrators were low-follower sock pages (B-13). May no longer be reproducible (X-2)
TikTokThree accounts in one cluster sell peptides and publish a phone number a puppy storefront also publishes (V-1)
Contact channelNo site in the network publishes a payment instrument. Every one funnels to WhatsApp deep links; the money moves elsewhere (U-8, T-8)
Attribution, stated precisely
The operator layer geolocates to Limbe, Southwest Region, Cameroon on account-registration artifacts across four independent platforms (Q-1, Q-8). The page-farming layer shows Bangladesh signals (A2-11, B-15) — plausibly a contracted supplier serving multiple unrelated fraud customers. The two layers are not in conflict; they describe different functions (Q-4).