Michael Koczwara correlates TraderTraitor infrastructure from two reported ROOFDECK C2s to 13 certificate-linked endpoints using shared mkcert issuer metadata, Authority Key Identifier values, TLS fingerprints, HTTP-response characteristics, and historical records. The report distinguishes known publicly reported C2s from related infrastructure candidates and documents independent public reporting for FLATROOF and ROOFDECK domains. It advises that shared fingerprints require supporting context and do not alone prove malicious activity.