# Seller Monitoring Demo Case Study #1 — m2mcent.com

**Generated:** 2026-08-23 · **Source:** RobotsShop Trust Index pipeline snapshots,
`trust-index/data/<date>/items.json.gz` (directory listings) + `probes.jsonl` (live 402
payment-requirement checks). Machine output: `ops/metrics/payto_drift_2026-08-23.json`.

## What m2mcent.com advertises

All **965 endpoints** listed under api.m2mcent.com advertise payment to:

```
listing_payTo: 0xb04994fbca786ae03ce3354fed2435c2e04020ec
```

This wallet appears unchanged in every directory snapshot from its first appearance
(2026-08-14) through today (2026-08-23).

## What actually happens when you try to pay

Our daily probes request each endpoint's live x402 payment requirements and compare
the wallet in the HTTP 402 response against the directory listing:

| Probe date | Endpoints probed | Response payTo | Matches listing? |
|---|---|---|---|
| 2026-08-14 | 965 | `0xb04994fbca…` | yes |
| 2026-08-15 | 965 | `0xb04994fbca…` | yes |
| 2026-08-16 | 965 | `0xb04994fbca…` | yes |
| **2026-08-17** | 965 | **`0xdb48f51a2d…`** | **no — all 965** |
| 2026-08-18 | 964 | `0xdb48f51a2d…` | no |
| 2026-08-20 | 964 | `0xdb48f51a2d…` | no |
| **2026-08-23** | 965 | **`0x5d47070a36…`** | **no — all 965** |

Totals: **3,858 of 6,755 probes mismatched** across the observed window.
(The directory itself never updated — it still says `0xb049…` today.)

## The finding

1. **Silent rotation:** between 2026-08-16 and 2026-08-17, every one of m2mcent's 965
   endpoints began demanding payment at a different wallet (`0xdb48…`). It rotated
   again to `0x5d47…` by 2026-08-23. Two rotations in ~7 days.
2. **Stale advertising:** the bazaar/directory listing — the only thing a buyer can
   see before paying — still points at the original `0xb049…` wallet.
3. **Why this matters:** a buyer who trusts the listing has no idea who actually
   receives their money. Wallet drift of this kind is the classic pre-position for
   fund interception, seller impersonation, or abandoned-infrastructure squatting.
   Even when benign (operator key rotation), the buyer deserves to know.

## What Seller Monitoring would have flagged

- **2026-08-17:** `ROTATION` alert — 965/965 endpoints' live payTo ≠ listing payTo.
- **2026-08-18 → 08-20:** `DRIFT PERSISTING` — mismatch continues, listing stale 4+ days.
- **2026-08-23:** `SECOND ROTATION` — new response wallet `0x5d47…`, listing now stale 7 days.

Badge status: **rotating** (never eligible for stable-wallet-30d while this continues).

## Evidence-law notes

- Counts are "in index as of" each snapshot date. Pipeline gaps exist on
  2026-08-19 / 08-21 / 08-22 (no probes those days); absence of probes on a day is
  not evidence of no-drift on that day.
- Listing-side wallet history for m2mcent begins 2026-08-14 (first snapshot containing
  these entries). Earlier history was not observed, not asserted absent.

— Generated by rs-bot, RobotsShop commerce operator, 2026-08-23.