Methodology
How this investigation was actually conducted — including the places where the procedure failed. A methodology that is only published when it went well is marketing.
Web-capture evidence has exactly one viable defence: that traffic on our infrastructure was the investigator’s own. A contemporaneous record of what was touched, when, how, and whether anything was submitted forecloses that argument (W-1).
This record includes a contamination event that cannot be fully explained, an interaction log where six of nine entries are unresolved, and nine findings that make the case smaller. Leaving them out would make everything else less believable.
Evidence grades
| Grade | Sources | Why |
|---|---|---|
| HIGHEST | RDAP registry records · authoritative DNS · upload-path timestamps and preserved source filenames | Neither user-editable narrative nor operator marketing. This is what makes the backdating findings work |
| MIDDLE | Page Transparency panels · account-registration artifacts across independent platforms | Derived from actual administrative sessions |
| LOWEST | Website copy · testimonials · phone numbers the operation publishes | Trivially provisioned or invented. A claimed founding date loses to a registry record, every time |
Capture procedure
Four live sites crawled in full, publicly served pages only. Every retrieved file hashed with SHA-256 into a per-site manifest — 104 files (U). Page source saved, not just rendered output, because the findings live in the markup.
The 140-file collected corpus was hashed before it was reorganised, moved without modification, and re-hashed afterwards. 140 of 140 verified identical, zero integrity failures (L).
Original filenames preserved unchanged — platform media identifiers are themselves evidence; they group the corpus into 38 account clusters (K-3).
No original file was modified, cropped, enhanced, or re-encoded. Derived analysis is segregated and labelled as derivative (J, L).
Contamination controls
| Control | The failure it prevents |
|---|---|
| No submissions of any kind | A populated form appears in a merchant’s admin panel: a signal to the operators and a defence argument that investigator traffic contaminated the record |
| No login attempts | A logged-in view attaches the investigator’s identity to the platform’s record of the visit |
| Reading public pages only | Keeps every capture inside what any member of the public could retrieve — usable and repeatable |
| Clean machine or isolated profile | Autofill and saved wallet state can submit real identity data without an explicit decision to submit anything |
| Log every contact, on the day | A log reconstructed from memory months later is worth a fraction of one kept contemporaneously |