# Treasury domains: operator and company connection investigation

## Provenance correction · requester clarification, 5 November 2026

The requester clarified that name similarity was the only basis for considering globaltreasury.solutions. The requester did not assert or establish that it was the website of UK company 15907803. Earlier wording describing a requester-reported company/website association was an analyst attribution error. Treat this as a name-based research hypothesis only.



## Later network-review update · 5 November 2026

The subsequent [two-network investigation](network-connection-investigation.md) recovered a specific infrastructure link: `globaltreasury.solutions` shares IPv4 **83.228.211.130** with `mail.zingalabs.org`, the current MX destination for Impact, GRiOT and Zinga. Historical provider address intervals overlap, without proving uninterrupted use or historical MX configuration. This updates any earlier broad statement below that no Global-to-Impact link was recovered. **The reported HTTP redirect remains unverified, and the link from company 15907803 or the named individuals to operation of the Global domain remains unestablished.** The original pass's observations and access failures are retained as research history.


**SOUNDPROOF · SP–GTS–001 · Focused public-source review, 5 November 2026 UTC**

## Follow-up update — recovered public page, 5 November 2026

**New evidence links the domain's published content directly to the Impact Capital brand. The connection to UK GLOBAL TREASURY SOLUTIONS LTD (15907803) is still unconfirmed.**

At **13:00:03.289362 UTC (20:00 Bangkok)**, a read-only GET of `https://globaltreasury.solutions/` returned HTTP **200** and a 12,572-byte HTML page titled **Global Treasury Solutions | Cross-Border Payments & Treasury Ops**. The public page states:

- Footer: **“Built by Impact Capital Management”**.
- Contact: **`info@impactcapital.ltd`**, with suggested subject **“GlobalTreasury launch”**.
- Contact form caption: messages go to that same Impact address. No form was submitted, and actual message delivery was not tested.

This is a specific **website-published builder/contact association**, stronger than the previously established shared-IP association. It is not a company-number-bearing legal notice, a verified registrant identity, proof of legal ownership, or proof that the UK company commissioned the work. The exact legal entity behind the credited brand is not identified on this Global page. Separately preserved, TLS-validated [Impact terms](https://studio.impactcapital.ltd/terms) identify IMPACT CAPITAL MANAGEMENT Sàrl, CHE-464.300.033 (source S23); that identification applies directly to the Impact website, not automatically to every site crediting its brand.

**Capture limitation:** ordinary certificate validation still fails because the Global domain's certificate is expired. The successful content capture explicitly disabled certificate validation for this public, unauthenticated GET. Therefore its contents cannot be authenticated through a valid TLS chain. The raw HTML, response headers, exact times, capture method and SHA-256 hash are preserved; repeated captures are same-origin observations, not independent authentication.

At **13:17:43 UTC**, the `www` homepage returned the identical HTML/hash with the same validation limitation. Standard `/robots.txt` and `/sitemap.xml` requests also returned that same HTML, rather than a robots file or sitemap; they supplied no additional URLs. The raw homepage has no occurrence of **15907803**, **Kovachev**, **Kovacheva**, or **treasurysolutions.com**. This is a finding about the retrieved body, not every past page or record.

The HTTP root returned **301 only to its own HTTPS root**; the successful HTTPS capture returned **200**, not an onward Impact redirect. The content association is now observed, while the previously reported historical redirect remains unverified. Its existence at another time is not disproved.

The fresh registry RDAP response again records registration on **22 January 2026** but names no registrant/customer. The registrar route and Wayback CDX returned **429**. A September 2026 Common Crawl domain query returned **504**. A July 2025 Common Crawl query for the separate email domain returned **404, “No Captures found for: treasurysolutions.com”**; that is a single-index result, not proof of historical absence. Fresh exact domain/company/person and Impact/Capitalixe pair searches recovered no attributable UK-company bridge. Search-tool response completion times were not instrumented.

**Current assessment:** `globaltreasury.solutions` → **published Impact builder/contact attribution: recovered, with expired-TLS limitation**. UK company **15907803** → `globaltreasury.solutions`: **a name-based hypothesis only; no company association asserted by the requester**. A historical contract, original email with company-identifying signature, company-number-bearing legal notice, or attributable domain/hosting customer record would address that remaining step.

Preserved evidence: [raw homepage](sources/company-domain-followup/global-expired-tls-public.body), [capture metadata](sources/company-domain-followup/global-expired-tls-public.json), [extracted text](sources/company-domain-followup/global-visible-text.txt), [second homepage capture](sources/company-domain-followup/global-www-public.json), [fresh registry response](sources/company-domain-followup/global-registry.body), and [capture directory](sources/company-domain-followup/). Primary page: [globaltreasury.solutions](https://globaltreasury.solutions/). Homepage SHA-256: `43f84e94b43149921216de578d5225127ff5be1a7cafec710d71ea68e7c31f91`.

The earlier findings below retain the prior TLS-validated-only review's scope. This update supersedes its blanket statement that no named builder/contact was recovered, while preserving the unresolved legal-operator and UK-company attribution.

## Earlier result — before the content capture

**The retrieved public evidence does not yet establish that `globaltreasury.solutions` is operated by GLOBAL TREASURY SOLUTIONS LTD (15907803), Ivan Kovachev, Elena Kovacheva, or the operator of `treasurysolutions.com`.** No named operator of `globaltreasury.solutions` was recovered. This is an unresolved attribution result, not a conclusion that the domains are unrelated or that Lissele's account is incorrect.

The evidence establishes several narrower facts: the registered company has the named directors; the supplied addresses literally use `treasurysolutions.com`; an indexed Treasury Solutions consultancy site publishes a general address at that domain; and independent infrastructure records place `globaltreasury.solutions` in January 2026. None supplies the missing operational bridge between all three identifiers.

This pass follows the earlier domain reports. It adds an indexed contact page, historical DNS for the global domain, a bounded certificate comparison, two additional archive services/routes, a fresh registry response and a document-by-document review of the company's five filings. Public-source research was split among corporate, indexed-content and technical researchers, with the conclusions reconciled here.

## Connection assessment

| Connection tested | Evidence and strength | What remains open |
|---|---|---|
| Ivan and Elena → company 15907803 | **Direct official role records.** The [officers page](https://find-and-update.company-information.service.gov.uk/company/15907803/officers) lists Ivan as director and Elena as director and secretary. Original documents separately establish initial shares/control and named strike-off authorisation. | Roles do not identify an operating website or prove use of a mailbox. |
| Supplied addresses → `treasurysolutions.com` | **Direct address syntax, requester provenance.** `ivan@treasurysolutions.com` and `elena@treasurysolutions.com` were supplied by Lissele. | No original emails independently establish who used or controlled them. Public exact-address searches did not supply corroboration. |
| Treasury Solutions brand → `treasurysolutions.com` and `info@treasurysolutions.com` | **Indexed page representation.** The homepage and a separately recovered `/contact` page associate that brand and general address with the domain. | The returned text does not name a legal operator, company number, Ivan or Elena. Live DNS/HTTP retrieval failed. |
| Company 15907803 → `globaltreasury.solutions` | **Name-based research hypothesis only. The requester did not assert a company/website association.** No independently retrieved company-number-bearing legal notice, contract, filing or domain record corroborates it. | Operator and company attribution remain unverified. |
| Company 15907803 → `treasurysolutions.com` | **Unestablished.** The named directors and supplied personal addresses are separate facts; the reviewed filings contain no target-domain disclosure. | A contemporaneous business document, operator notice or attributable service record is needed. |
| `treasurysolutions.com` ↔ `globaltreasury.solutions` | **Unestablished.** No cross-link, common named registrant, joint certificate or attributable document was recovered. | Neither common names nor a common registrar establishes common ownership. Different records do not prove different ownership either. |
| `globaltreasury.solutions` → Impact Capital | **Requester-reported onward route.** Ordinary validated retrieval still stops at an expired certificate. | The separately verified Impact-root-to-studio redirect cannot establish this missing first hop or identify who controlled it. |

## DB01 — Indexed consultancy and contact page

The indexed [homepage](https://www.treasurysolutions.com/) describes payments/banking introductions, FX and high-risk-sector advisory services. A separately indexed [contact page](https://www.treasurysolutions.com/contact) contains a form and **`info@treasurysolutions.com`**. A short supporting page label is “Your trusted fintech advisory.” This establishes a brand/domain/general-contact representation, not a named legal operator or a particular client's transaction.

The search provider reports a relative crawl age of four months. No exact crawl or publication timestamp was supplied. The public-content branch recorded the relevant query start at **2026-11-05 12:23:20 UTC**; the exact response completion was not instrumented. Both pages' returned text is preserved in [the search response](sources/domain-bridge-public/web-search-4.json). Direct requests failed DNS resolution, search-tool opens returned 502, and the browser also reported `ERR_NAME_NOT_RESOLVED`. The website is not described here as live.

The visible Privacy Policy label became a new lead. Site-limited legal/controller/company-number/PDF queries, ordinary candidate legal-page requests, robots/sitemap attempts and archive recovery did not recover its destination or body. Candidate `/privacy-policy` and `/terms-and-conditions` paths were guesses, not discovered links or proof those pages exist. No Wix/site ID, analytics identifier or hidden operator field was recovered. See [DBP01–DBP06](domain-bridge-public.md) for exact queries and failures.

## DB02 — Global-domain history corroborates infrastructure, not ownership

A fresh [registry RDAP response](https://rdap.identitydigital.services/rdap/domain/globaltreasury.solutions), retrieved **2026-11-05T12:24:12.334210 UTC**, again records registration **22 January 2026 at 13:12:55.802 UTC**, registrar GoDaddy and `ns43.domaincontrol.com` / `ns44.domaincontrol.com`. Its public registry record identifies the registrar, not a named registrant/customer. The registrar's public RDAP route returned **429** on the bounded follow-up; it supplied no operator identity.

The public WhoisFreaks historical record adds a provider-observed interval beginning **24 January 2026** and ending **9 August 2026**, with IPv4 `83.228.211.130`, IPv6 `2001:1600:18:102::388` and the same nameservers. These are provider observations, not creation dates, continuous-use evidence or authenticated ownership records. The SOA serial is a zone version, not a mailbox-opening date. Its MX-filter view's no-record display describes the provider's returned coverage, not proof no MX ever existed.

RIPE records identify the global domain's historical IP allocations as Infomaniak network space. A network allocation identifies a provider, not the website subscriber, legal operator or beneficial owner. No subject/company relationship is inferred from the provider's Swiss location. The email domain's available April 2025 DNS snapshot has different address/nameserver values; this supplies no distinctive shared identifier, and the observations are not contemporaneous ownership certificates. Exact source retrieval times and excerpts are preserved in [the technical report](domain-bridge-technical.md).

The company's incorporation, the email domain's provider-first-seen MX date, the global domain's registration, certificate and DNS observations remain distinct chronology entries. The registry's current registration event does not certify every possible earlier domain lifecycle.

## DB03 — Certificate comparison has limited coverage

The previously preserved global-domain leaf certificate covers the root and `www` names and carries validity/SCT events on **23 January 2026**. Fresh CertSpotter results for the email domain returned five unexpired certificates, including validity starts on **3–4 November 2026**. Their names cover only `treasurysolutions.com` and its wildcard. None contains the global domain, and none shares the public-key hash of the one preserved global-domain leaf certificate. The next-page request returned an empty list.

This is a completed comparison of that returned set. The public endpoint supplies unexpired certificates, not a complete historical certificate census; its empty global-domain response is compatible with the known expired global certificate. No joint certificate or shared key was found in the inspected set. Separate certificates/keys do not establish separate owners. Fresh mail-domain certificate activity does not prove a live consultancy, named mailbox use, trading or continuity after the company's dissolution. See the preserved [comparison](sources/domain-bridge-technical/certificate-comparison.json) and the technical report's primary API documentation.

## DB04 — Additional archives return bounded results

The Internet Archive's [Availability API documentation](https://archive.org/help/wayback_api.php) explains that its response returns one closest accessible snapshot. An empty snapshot object can mean not archived **or currently inaccessible**; it is not a complete capture inventory.

- The [global-root query](https://archive.org/wayback/available?url=globaltreasury.solutions&timestamp=20261105), retrieved **2026-11-05T12:24:59.213470 UTC**, returned `archived_snapshots: {}`. It did not identify a usable root snapshot. Subpages and other captures are not excluded by that result.
- The [email-domain query](https://archive.org/wayback/available?url=www.treasurysolutions.com&timestamp=20261105), retrieved **2026-11-05T12:24:56.758884 UTC**, returned the already preserved **14 August 2024, 23:04:16 UTC** capture. Its actual content is only a 114-byte `/lander` redirect. It is not the modern advisory website or proof of either person's activity before incorporation.
- Arquivo.pt's two exact root-version-history queries returned HTTP 200 with zero results. That service primarily archives Portuguese material and has limited coverage; these are service/query-specific outcomes.
- Common Crawl supplied collection metadata, but broader and exact-home/root queries in distinct 2026 indexes returned 504. Existing public urlscan results were empty within an explicit **30-day** limit. Prior CDX requests returned 429. None is proof no historical site, redirect or scan existed.

The successful empty API responses remain separate from failed retrievals. No archive capture was invented, no new scan submitted, and no TLS warning or certificate validation was bypassed. Root archive bodies, documentation, headers, exact timestamps and hashes are under [the root source directory](sources/domain-bridge-root/).

## DB05 — Corporate documents do not supply domain attribution

The corporate researcher re-examined all five preserved GTS filings: incorporation (30 pages), CS01 (3), DS01 (1), and first/final Gazette notices (one each). Native text, all image-page content, PDF metadata and URI annotations were considered. No target domain, supplied mailbox, operational website statement or named formation/domain agent was found in those public documents. An empty text layer on an image page was not treated as empty content.

This is a bounded **36-page review** and not an assertion about every internal company record or information withheld from a public filing. The sources retain their original acquisition dates; review at **2026-11-05T12:26:10.721905 UTC** is not a new remote retrieval. Four exact searches pairing the legal name/number with each domain returned empty results in the recorded tool batch at **12:25:10 UTC**. The older identically named company **06459172** remains a distinct entity and is not attributed to this case through its name. See [the document-by-document report](domain-bridge-corporate.md).

## DB06 — Operator finding and remaining evidence

The operator of `globaltreasury.solutions` remains **unidentified from the retrieved public evidence**. GoDaddy is a registrar; Infomaniak is an IP-network provider; Let's Encrypt is a certificate issuer. None is thereby established as the business operating the website. A reported onward route to a Swiss company's website cannot automatically identify the historical controller of the starting domain.

The following evidence would materially change that assessment:

1. A dated terms, privacy or legal page, or an archived document, explicitly identifying the operator and preferably company number **15907803**.
2. Original `.eml` correspondence with full headers and a contemporaneous company-number-bearing signature, reinforced by a contract, invoice or counterparty record. Headers alone do not prove beneficial ownership.
3. An attributable domain/hosting/mail-service customer record identifying the controlling person or company, with its date and provenance.
4. A preserved dated redirect/cross-link capture naming both domains. That would establish routing/association at that time; company ownership would still require its own evidence.

These are focused evidence gaps, not a request to repeat already recorded searches. The ordinary public routes tried in this pass ended in a retrieved record, a bounded search outcome or a specific access/attribution blocker. New material identifiers—contact URL/email, DNS addresses, certificate records and archive API results—were followed through. No accessible source recovered a named global-domain operator or the missing legal-entity bridge. This is bounded public-source completion, not a claim that the entire internet or non-public company records have been exhausted.

## Preservation and application update

Sources and timing metadata are under `sources/domain-bridge-root/`, `sources/domain-bridge-public/`, `sources/domain-bridge-technical/` and `sources/domain-bridge-corporate/`. Branch findings keep DBP, DBT and DBC identifiers; the [ID crosswalk](finding-id-crosswalk.md) maps them to the application findings. Raw results, failed attempts, short excerpts, local review records and hashes are preserved. Hashes support later file-integrity comparisons; they do not independently authenticate publisher assertions or guarantee admissibility.

The SOUNDPROOF evidence register, New findings, domain panels, report library, chronology and research queue reflect this distinction between documented infrastructure and unverified operation. Proposed company/domain and domain/domain connections remain questions, hidden by default in the map. No contact, impersonation, account access, mailbox test, active scan or external publication was performed.