Additional public source checks, 31 October 2026.

Captured GoPlus responses are provider risk assertions at their recorded query time. The collector flag names SlowMist, but supplies no underlying report date, transaction references or operator identity. Zero flags do not clear the secondary account.

Project metadata authenticates a historical editorial-contact statement, not deployment access. OTX hashes match the retained script; its pulse cites the known Hudson Rock article. Registry copies, formats and references are not counted as independent incident observations.

This archive includes curated source URLs, dates, hashes, coverage and two complete public risk-API JSON responses. Full social/profile/article/README and malware/report bodies are excluded. The file hashes verify the contents of this evidence package; they do not independently authenticate omitted original responses. No new transfer or Car-drainer control relationship is asserted.
