WORKSPACE STUDY 01 · UNIVERSAL SHELL / CONTENT-NATIVE VIEWS

Impersonation activity is active across the open web.

One reproducible pass across public and licensed sources. Every claim is dated, sourced, and typed by epistemic class.

Verified Components

EVERY COMPONENT CAN ENTER THE FILE

OBSERVATION · CRITICAL

northwind-shop.site is a working clone storefront.

The site is taking orders under the subject's name and uses copied product photography. Registered 27 days ago.

VERIFIED TODAY · SCREENSHOT ON FILE · SOURCE CLASS PUBLIC · CMP-8F3A

DERIVED FACT · HIGH

Seven lookalikes can send mail under the subject's name.

Live MX records make each domain capable of sending messages that visually resemble the subject's addresses.

northw1nd.compark-mx.above.comVERIFIED

northwind.supportmx.routehost.netVERIFIED

northwind-online.commx.routehost.netVERIFIED

RULE MX-LIVE@4.2 · 7 / 21 · INPUT SNAPSHOT 03:10:02 PT · CMP-31B7

SCORED INFERENCE · CONF 0.94

Four storefronts likely share one operating cluster.

They share payment rail, theme fingerprint, image assets, and hosting patterns. This is a scored inference, not a direct observation.

MODEL ER-12@2.8 · CONFIDENCE 0.94 · 4 CORROBORATING FEATURES · CMP-7CC2

NATIVE RENDERER · RELATIONSHIP DATA

One shared rail connects four storefronts.

The universal Component contract stays fixed. The center view is perfected for graph relationships.

TRACE MAP · 6 NODES / 8 EDGES

DERIVED FACT · TRACE MAP

Four storefronts converge on one shared payment rail through eight verified relationships.

6 NODES · 8 EDGES · RULE GRAPH-JOIN@3.1 · SNAPSHOT 03:10:02 PT · CMP-A991

NATIVE RENDERER · TEMPORAL DATA

Activity accelerated across six days.

Temporal Components use a chronology renderer while preserving the same binding, provenance, and export behavior.

TIMELINE · 3 VERIFIED EVENTS

OBSERVATION · TIMELINE

AUG 03 · 21:14

Mail route activated
MX appeared on northw1nd.com.

AUG 02 · 13:41

Clone storefront went live
Checkout became reachable on northwind-shop.site.

JUL 29 · 08:02

Certificate issued
TLS certificate observed for two related hosts.

EVENTS 3 · SOURCES 4 · WINDOW 6 DAYS · CMP-D120

NATIVE RENDERER · ENTITY DATA

One resolved profile, with conflicts left visible.

Entity views privilege identifiers, resolution lineage, and disagreement. Missing data remains missing.

ENTITY PROFILE · RESOLUTION 0.97

SCORED INFERENCE · CONF 0.97

Operator cluster OR-449 resolves across seven identifiers.

Resolution is based on shared infrastructure and payment data. Registrant country conflicts across two sources and remains unresolved.

CLUSTER

OR-449

IDENTIFIERS

7 linked

COUNTRY

Conflict · unresolved

FIRST SEEN

29 Jul 2026

PAYMENT RAIL

Shared · 9A

LEGAL NAME

Missing

MODEL RESOLVE@5.1 · CONFIDENCE 0.97 · CONFLICTS 1 · MISSING FIELDS 1 · CMP-E44F

NATIVE RENDERER · SOURCE DATA

Every claim returns to a source record.

Source views privilege capture time, source class, integrity state, and the exact Components each source supports.

SOURCE LEDGER · 4 RECORDS

OBSERVATION · SOURCE RECORD

SOURCECAPTUREDSUPPORTSSTATE

DNS snapshot03:10:02 PT31B7 · A991VERIFIED

Storefront capture03:09:41 PT8F3AVERIFIED

Certificate log03:08:19 PTD120VERIFIED

Registrant record03:07:54 PTE44FCONFLICT

SOURCES 4 · VERIFIED 3 · CONFLICT 1 · SNAPSHOT SET SRC-20260804-0310 · CMP-S220

NATIVE RENDERER · CUSTODY DATA

The record is traceable from capture to File.

Custody views privilege ordered events, immutable identifiers, operators, and integrity checks.

CUSTODY CHAIN · 3 EVENTS

DERIVED FACT · CUSTODY BLOCK

01 · CAPTURE

Source set fixed

Four source records entered snapshot SRC-20260804-0310.

03:10:02 PT
SHA 2EA4…919C

02 · SYNTHESIS

Rules executed

Ruleset 2026.08.04 produced typed Components.

03:10:03 PT
RUN R-2048

03 · BIND

Components pinned

Eight exact Component versions entered the draft File.

03:10:04 PT
FILE F-104

CHAIN EVENTS 3 · BREAKS 0 · FILE F-104 · CMP-C802