# Technical links across the two business networks

## Sources.Africa infrastructure lead → actor check — 5 November 2026

**Positive result: Sources.Africa has a specific infrastructure association with Impact, stronger than generic hosting-provider overlap. No Ivan/affiliate-to-Sources connection is established.** This supersedes treating Sources solely as a byline candidate; legal operator identity remains unresolved.

| Fresh observation | Exact result | What it establishes |
|---|---|---|
| Sources root and www A | `83.228.211.130` | Website address equality with Global and Zinga mail. |
| Sources MX | `10 mail.zingalabs.org` | The same specific mail-routing destination as Impact. |
| Sources SPF | `v=spf1 mx ip4:83.228.211.130 -all` | Authorises its MX and that IPv4 to send mail. |
| Impact MX / SPF | `10 mail.zingalabs.org`; `v=spf1 ip4:83.228.211.130 ~all` | Specific shared mail configuration. Impact's public web A records are Cloudflare addresses, so web-A equality with Impact is not claimed. |
| Capitalixe .com / .ae MX and SPF | Proofpoint MX; Google SPF | Different public mail routing. Cloudflare front ends conceal origins, so different web IPs cannot exclude a shared hidden origin. |

Primary DNS: [Sources A](https://dns.google/resolve?name=sources.africa&type=A), [Sources MX](https://dns.google/resolve?name=sources.africa&type=MX), [Sources TXT](https://dns.google/resolve?name=sources.africa&type=TXT), [Impact MX](https://dns.google/resolve?name=impactcapital.ltd&type=MX), [Impact TXT](https://dns.google/resolve?name=impactcapital.ltd&type=TXT). Captured at approximately 15:49:55–15:49:57 UTC; individual exact times, URLs, hashes and answers are in [DNS summary](sources/sources-africa/dns-summary.json). Direct queries to ns69.domaincontrol.com timed out; they are not independent corroboration.

The defensible route is **Sources.Africa → MX → Zinga mail ← MX ← Impact**. Sources also shares the Global web IPv4. These are observations about infrastructure; they do not identify the hosting subscriber, prove common ownership or establish that Sources is an Impact investment or operating company. The earlier Y. Mouanfon byline is consistent with the research lead but still does not independently identify the registered Swiss member-manager.

### What was tested toward Ivan

The Sources [contact](https://www.sources.africa/en/contact), [finance](https://www.sources.africa/en/finance), [partnership](https://www.sources.africa/en/partnership), hub, blog and linked article were captured. Four public contacts were recovered: contact@, partenariat@, media@ and support@ **sources.africa**. No contact matches the actor-side identifiers. No external business hyperlink, named Ivan/Elena/Capitalixe/Pinnacle/GTS/DESMEL counterparty or UK/UAE company identifier was recovered from these pages. The finance page describes a **proposed Sources Africa Community Climate Asset Finance Facility**, with manager, jurisdiction and contractual relationships still to be agreed; this is not an identified partner bank or registered company. Generic references to impact capital are not the Swiss legal name.

The [registry RDAP](https://rdap.nic.africa/rdap/domain/sources.africa) records registration **23 May 2026 at 09:17:05.082746 UTC**, GoDaddy and ns69/ns70.domaincontrol.com. It publishes privacy service **Domains By Proxy, LLC**, not the underlying customer. Registrar/abuse staff and contacts are excluded as operator candidates. The 4 June last-changed event is not treated as ownership transfer.

Public [Sources A history](https://whoisfreaks.com/tools/dns/history/lookup/sources.africa?type=A&page=1) exposes `83.228.211.130`, first seen **25 May**, last seen **16 August 2026**. The limited exposed [Capitalixe.com history](https://whoisfreaks.com/tools/dns/history/lookup/capitalixe.com?type=A&page=1) row is `160.153.133.150` (31 August 2023–4 July 2024); [.ae](https://whoisfreaks.com/tools/dns/history/lookup/capitalixe.ae?type=A&page=1) shows `188.114.97.3` / `188.114.96.3` (20 November 2025–6 February 2026). These do not supply an IP match. Other rows are sign-in masked; dummy 1999 placeholders are not observations. This does not exclude a match in unavailable history or hidden origins.

The public certificate index disclosed `wedevnext.sources.africa`; a single ordinary public root GET returned a French Sources homepage. No actor or named developer connection emerged. The hostname is not proof of an agency identity. No exact certificate public-key match was found in the preserved case certificate set. crt.sh failed with 502; the separately captured CertSpotter result supplies the hostname observation.

The expanded audit covers **43 entities, 66 relationships (49 documented), 98 saved HTML captures across 14 root domains**, including Sources and its public subdomain. It finds no cross-group anchor, person/company mention, matching extracted business contact, tracker/site ID or exact external link. Documented-edge paths from the assessed Ivan/affiliate nodes to Sources remain absent, while the positive Sources-to-Impact infrastructure path is present. Recaptures are not independent websites. [Audit](sources/sources-africa/audit-result.json) · [script](sources/sources-africa/audit.py) · [11-query ledger](sources/sources-africa/search-ledger.json).

**Timing retained without attribution:** Sources registered three calendar days before GTS dissolution (26 May) and four after the final notice's printed strike-off date (19 May). The historical address was first observed one day before dissolution. These are real date comparisons across still-unconnected actors, not evidence Ivan registered the domain or transferred business. Neither first-seen nor registry registration proves launch or activity.

**Remaining missing step:** a named Sources operator/customer/contact or transaction identifying Ivan or a demonstrated affiliate. The IP/MX lead establishes a new technical member of the target infrastructure, but it does not close that actor-side gap. No subject was contacted, and no sign-in or private account was accessed.


Case SP–GTS–001 · 5 November 2026 · Public records captured approximately 12:39–12:47 UTC.

**There is now a concrete infrastructure connection between `globaltreasury.solutions` and the Impact/Zinga/GRiOT network.** Global Treasury’s web hostname and the network’s custom mail hostname currently resolve to the same IPv4 address, independently corroborated with Google DNS and authoritative DNS. Public historical DNS also places that address in both names’ observation histories.

**Separately, official .ae WHOIS directly names `IvanKovachev` and `Capitalixe LLC-FZ` in Capitalixe’s regional-domain registration.** The missing attribution remains the bridge from Ivan/Elena, TreasurySolutions.com or GTS company 15907803 into the Global Treasury/Impact technical network. A shared server is not itself evidence identifying its customer, business owner or director.

The Side A / Side B labels follow the requested research grouping; they do not assert that every entity within a side has common ownership. In particular, the UK company’s connection to the Global Treasury domain remains a separate unresolved relationship.

## NT-F01 · An independently corroborated current DNS chain

```text
globaltreasury.solutions ── A ──► 83.228.211.130
                                      ▲
mail.zingalabs.org ───────── A ─────────┘
       ▲
       ├── MX of impactcapital.ltd
       ├── MX of griot.im
       └── MX of zingalabs.org
```

Google’s public DNS JSON returned the same address for [Global Treasury](https://dns.google/resolve?name=globaltreasury.solutions&type=A) at **12:42:46.972425 UTC** and [the Zinga mail host](https://dns.google/resolve?name=mail.zingalabs.org&type=A) at **12:42:46.971608 UTC**. Separate non-recursive queries to `ns43.domaincontrol.com` and `jule.ns.cloudflare.com` returned authoritative (`aa`) answers for the respective names, again `83.228.211.130`. The ordinary resolver captures from the earlier network inventory agree.

Google JSON also corroborated the MX routing for [Impact](https://dns.google/resolve?name=impactcapital.ltd&type=MX), [GRiOT](https://dns.google/resolve?name=griot.im&type=MX) and [Zinga](https://dns.google/resolve?name=zingalabs.org&type=MX) at **12:43:20.631287**, **12:43:20.917450** and **12:43:20.595745 UTC**, respectively. Impact and Zinga use priority 10; GRiOT uses priority 1.

This documents an infrastructure association more specific than merely using the same hosting company. It does **not** prove that the host is dedicated, who configured it, that the three businesses have common legal ownership, or that GTS company 15907803 owns the Global Treasury domain. The previously captured expired-certificate block remains in place: this finding does not claim an independently observed HTTP redirect to Impact.

The Global Treasury hostname also has IPv6 `2001:1600:18:102::388`; the current mail-host AAAA query returned no answer. **The shared-address finding is IPv4 only.**

## NT-F02 · Historical observation intervals overlap

The public [mail.zingalabs.org A-history filter](https://whoisfreaks.com/tools/dns/history/lookup/mail.zingalabs.org?type=A&page=1), retrieved **12:42:48.834482 UTC**, displays one address, `83.228.211.130`, with first seen **7 November 2025** and last seen **28 June 2026**.

The earlier preserved [Global Treasury history](https://whoisfreaks.com/tools/dns/history/lookup/globaltreasury.solutions), retrieved **12:24:36.567286 UTC**, displays the same address with first seen **24 January 2026** and last seen **9 August 2026**. Their provider-labelled intervals overlap **24 January–28 June 2026**.

This is a historical technical clue. First/last-seen intervals do not certify uninterrupted daily resolution or the dates a customer acquired either service. They must not be relabelled as launch, trading, ownership or mailbox-creation dates. The public pages warn that anonymous results can be stale. No gated history was read.

## NT-F03 · Official Capitalixe.ae registrant attribution

The official WHOIS service listed by [IANA for .ae](https://www.iana.org/domains/root/db/ae.html), `whois.aeda.net.ae`, returned:

| Field | Returned value |
| --- | --- |
| Domain | `capitalixe.ae` |
| Registrant contact name | `IvanKovachev` |
| Registrant contact organization | `Capitalixe LLC-FZ` |
| Technical contact name and organization | The same name and organization |
| Registrar | Etisalat |
| Nameservers | `sneh.ns.cloudflare.com`, `yadiel.ns.cloudflare.com` |

The exact request/completion timestamps and unmodified response are preserved in `sources/network-technical/whois-capitalixe.ae.{json,txt}`. This is **registrant-filed data from an official public service**, not independent verification of the person who supplied it or of corporate ownership/directorship. The organization string supplies an exact comparison point for the separate Dubai licence investigation; do not silently treat legal-name variants as identical.

This closes a useful A-side domain-attribution gap. It does not tie Ivan to any Side B domain.

## NT-F04 · Distinctive Capitalixe website identifiers match within Side A

Sixty preserved successful public HTML captures across ten root domains were compared for published tracking/site identifiers and explicit links to the named domains. The exact shared identifiers found were all **Capitalixe.com ↔ Capitalixe.ae**:

| Identifier type | Exact value |
| --- | --- |
| Google Tag Manager container | `GTM-NV9KVKH` |
| HubSpot portal | `24898650` |
| Hotjar site | `3114726` |

The two domains also publish the same DNS Microsoft verification token `MS=ms92540584` and the same Google site-verification token, and use the same Proofpoint MX pair (`mx1-us1.ppe-hosted.com`, `mx2-us1.ppe-hosted.com`). These are specific common-configuration observations within the A-side Capitalixe properties. They could reflect administration by an organization or its service providers; they do not on their own prove share ownership.

The source-page URLs, original retrieval timestamps, exact identifier contexts and raw-file hashes are in `html-identifier-comparison.json`. **No matching cross-A/B tracking identifier or anchor link was found in that retrieved HTML set.** Global Treasury, Pinnacle and TreasurySolutions.com had no successful modern page source in that set, so they were not treated as searched HTML. This limitation is central to the negative comparison.

## NT-F05 · Two specific Side B mail-routing clusters

- Impact, GRiOT and Zinga route mail to `mail.zingalabs.org`, as documented above.
- `101re.org` and `afriklease.com` route mail to `mail.viplink.club`, which currently resolves to **5.189.165.168**. This is a specific shared custom MX target. The `viplink.club` root uses the same `jule`/`sid` Cloudflare nameserver pair as several Side B properties. Root investigation owns the separate public operator check for the newly identified VIPLink domain.
- `agriland.io` instead routes to `mail.agriland.io`, resolving to **54.38.91.29**. It is not the shared Global Treasury/Zinga address in the captured records.

No mail was sent, no SMTP connection was made, and no mailbox’s existence or user was tested. MX targets describe configured routing, not proof that a customer relationship or a legal ownership relationship exists.

## NT-F06 · Nameserver clusters are corroborating configuration clues

The exact Cloudflare pair `jule.ns.cloudflare.com` / `sid.ns.cloudflare.com` appears for **Impact, GRiOT, Zinga, RocketWeb3, 101RE, Agrimine and VIPLink**. Capitalixe.com and Capitalixe.ae use a different exact pair, `sneh` / `yadiel`; TreasurySolutions.com uses `carol` / `dom`.

This is stronger descriptive information than the generic statement “both use Cloudflare,” but it is still a **weak attribution clue**. A nameserver pair does not establish that domains sit in one Cloudflare account, share a controller, or are legally owned by the same person. The observed linked Side B sites already independently advertise relationships among themselves; nameserver clustering can corroborate a technical pattern but cannot replace those legal and public-page sources.

Global Treasury uses `ns43`/`ns44.domaincontrol.com`. Agriland uses `dns1`/`dns2.registrar-servers.com`; Swisscofunding uses `ns11`/`ns12.infomaniak.ch`. These differences do not prove different ownership either.

## NT-F07 · Certificate comparisons yielded no cross-side identity

Thirty-eight returned unexpired certificate issuance objects—new root-host queries for twelve domains plus the earlier explicitly paginated TreasurySolutions.com query—contain **38 distinct public-key hashes**. The corresponding documented next pages all returned empty arrays. No returned certificate has a joint A-side/B-side SAN set and none shares a public key across the compared root domains.

**NT-F08 · Named-host certificate pairing:** `afriklease.com` with **`polymarkt.afriklease.com`**, certificate API issuance ID `17610696715`, validity start **6 October 2026 at 00:55:52 UTC**. This independently supports the known parent-domain/subdomain infrastructure relationship, not a connection to the UK subjects.

The API covers **unexpired certificates**. New queries were for the named root host rather than an exhaustive subordinate-host namespace; unrelated subdomain-only certificates can be missed. The earlier Global Treasury leaf was expired and was compared separately in [the domain-bridge technical report](domain-bridge-technical.md). Absence of a shared key in this set cannot exclude past common administration or a historical relationship. Issuer names and coincident renewal dates are mainstream-provider clues, not operator identities.

## NT-F09 · Registrar comparisons offer weak context, not an ownership bridge

Authoritative registry RDAP responses identify:

| Domain | Current registrar | Registry registration date |
| --- | --- | --- |
| Capitalixe.com | GoDaddy | 27 February 2019 |
| Impactcapital.ltd | Cloudflare | 24 September 2023 |
| Zingalabs.org | Key-Systems | 26 August 2025 |
| Swisscofunding.com | Infomaniak | 26 April 2021 |
| 101re.org | Key-Systems | 28 October 2024 |
| Afriklease.com | Infomaniak | 26 August 2014 |
| VIPLink.club | GoDaddy | 23 February 2026 |

Official WHOIS, reached through IANA-listed services where no RDAP endpoint was listed, additionally reports Agriland at Namecheap (21 November 2021), RocketWeb3 at Instra (19 December 2021), Agrimine at Instra (19 May 2021), and the .ae registrar noted above. GRiOT’s owner information is redacted. These records are preserved separately with per-request timestamps.

GoDaddy also appears in the earlier focal-domain records. This is a common retail registrar and is not a bridge between the businesses. Likewise, Infomaniak’s network administration for the shared server and its registrar role for other sites do not identify a subscriber. Registration dates are domain-registry events, not company creation or proof of a website launch.

## NT-F10 · The focal-domain WHOIS route did not expose registrants

A single public GoDaddy WHOIS query for each focal domain returned a message that its WHOIS server is being retired, followed by a rate-limit response. No retry was attempted. The .com registry WHOIS response identifies the registrar but supplies no registrant organization. IANA’s current .solutions delegation lists no registry WHOIS server; none was guessed. This materially different public registration route did not close the A↔B ownership bridge.

## NT-F11 · What remains missing across A and B

The observations above establish technical connections **within Side B** and a new named registrant **within Side A**. None of the retrieved cross-comparison sources attributes the shared Global Treasury/Zinga infrastructure to Ivan Kovachev, Elena Kovacheva, TreasurySolutions.com or the UK company 15907803.

TreasurySolutions.com currently routes mail through Microsoft mail protection; the Capitalixe domains route through Proofpoint. Neither observed A-side route points to the Side B custom mail host or the shared IPv4 address. That is a bounded configuration comparison, not proof the networks are unrelated.

The missing edge requires a business/operator identifier, a dated original document, a domain-registration identity, a named-person account or communication attribution, or an independently documented business relationship. Provider similarity and same-day events may guide further research but should remain visibly weak clues.

## Preservation and method

The collection used known public domains, ordinary DNS records, public registry/WHOIS responses, existing certificate-index records and already captured HTML. It made no new scanning submissions, service scans, contact attempts, account access or invalid-TLS exceptions. Two optional Cloudflare DNS-JSON requests returned 400 because the request lacked the provider’s required Accept header; those are retained as unsuccessful request-format results. Successful Google JSON and authoritative DNS provide the corroboration above.

Raw data, timestamps, identifier excerpts, comparison output and SHA-256 manifest are under `sources/network-technical/`. The machine-readable companion, [network-technical-findings.json](network-technical-findings.json), uses stable `NT-Fxx` findings and source references for integration. Existing source files are referenced with their hashes and original retrieval metadata rather than silently re-dated as new captures.