Connecting CLOVE’s admin site to its official systems: the evidence, nine questions and how to check
An unfamiliar admin address can be dismissed as a copy. A screenshot can be disputed. But company publications, official application code, Google’s project configuration and an earlier web archive require a more specific answer.
Three-step screenshot guide: inspect the source yourself
Here are the sources behind the investigation. You do not have to accept Parrot’s interpretation to check the files, follow the connections and identify what the records actually establish.
Read the investigation · Download the evidence · Check it yourself
Evidence reviewed: 5 September 2026. The nine explanations below are prospective questions, not statements CLOVE has made.
Do not take our word for it: open the code in three steps
Open the URL, paste the name into Find, and read the source yourself. These four images are actual Chrome screenshots. Click any image to enlarge it.
Step 1: identify the admin sign-in page, then check Google’s list
Open the admin entry point. It redirects to a sign-in page. This screenshot identifies the entrance; the next source connects the domain to CLOVE’s official systems.
The official website and admin sign-in code use the same project configuration. Google’s response for that project also lists clove.jp, oripa.clove.jp and clv-admn-next.vercel.app together. Open the preserved original Google response and compare them. This supports a technical connection at the project-configuration level; the list is not a certificate of company ownership.
Step 2: open the two public front-end files directly
No account or sign-in is needed. Open:
- Operation definition: 2902-1b4cb7dff6c6ef54.js to read the full name and input parameter.
- Japanese admin page: list-0f33ebdda397cc72.js to see the pool IDs being submitted and the result being read.
The dense text is normal: this is code the website sends to browsers. Leave it unchanged and use Find.
Step 3: press Ctrl+F and paste the exact name
Press Ctrl+F on Windows/Linux or ⌘+F on Mac. Paste this entire name without extra spaces, then press Enter:
scheduleAssignGuaranteedWinOripaUsersThere are 2 matches in the definition file and 3 in the Japanese admin page file. These counts describe the files read on 2026-09-05. If the site replaces them, compare the preserved versions in the source packages below.
The name exists in the source, and the admin page handles its result. You can check that directly. How the server chooses users, and which paid transactions used it, still require execution and transaction records.
Screenshots and code checked on 2026-09-05. Images, sources and file hashes. This illustrated guide is a new supplement; existing ZIPs retain their archived editions and signatures.
Picture a shop, a back room and an address book
There are five checks:
- Read the shop’s introduction. Does the company identify the brand as its service?
- Compare department numbers. Do the shop-front and back-room forms carry the same identifiers?
- Check the address book. Does Google, the system provider, list both addresses together?
- Open an older copy. Does material preserved by somebody else match the file now being examined?
- Ask for the work record. A task in a handbook still needs a log to show when it was performed.
The first four checks have source material you can open. The fifth needs execution and transaction records. Connecting the shop to its back room does not show who received which prize.
These are analogies. The actual “address book” is a list of permitted redirect domains, not a property deed or staff register. The original sources follow.
Open the original-source comparison
Start with the company and the product
TrustHub’s website lists Clove Oripa as a service and links to oripa.clove.jp. Apple’s Clove listing names TRUST HUB, K.K. as supplier. A company-issued announcement and SMBC’s announcement of 15 October 2024 also connect the business to Clove.
That establishes the company–product link. The admin site requires a separate technical connection.
The official site and admin sign-in share a project
Compare the official clove.jp JavaScript with the admin sign-in JavaScript. Both contain these public Firebase identifiers:
| Identifier | Shared value |
|---|---|
| Project ID | clove-v2-prd |
| App ID | 1:385949280493:web:224ed7999dd0740cfdc4e4 |
| Authentication domain | clove-v2-prd.firebaseapp.com |
The public configuration keys also have the same hash; see identity-chain-sources.json in the identity package. Firebase documents these keys as project identifiers, not admin login credentials.
Public code can be copied. Matching code is therefore the beginning of this connection, not its final step.
Google’s response includes the admin domain
At approximately 03:56 UTC on 5 September 2026, Google’s public project-configuration endpoint returned HTTP 200 when queried using the public configuration identifier from each application. The two response bodies are byte-identical. Both identify project number 385949280493.
The authorizedDomains array includes clove.jp, oripa.clove.jp and clv-admn-next.vercel.app.
The connection extends into configuration returned by Google. An explanation that the admin address is wholly unrelated now has to account for its presence in this project’s authorized-domain list.
Google defines this field as domains authorized for widget redirects. It supports a technical configuration link; it does not identify a legal owner, Vercel account holder or operator. IAM records, domain changes and deployment history would establish who controlled each part and when.
The two captured Google JSON files are in public-captures/. Their SHA-256 is:
7a574650bdfa74f1460bb31500d691ff8d6a386660b56cfe21239675e936228bAn earlier archive anchors the official code version
Wayback’s official-JS copy from 23 August 2026 at 02:14:55 UTC is byte-identical to the official file preserved on 5 September. That code was available before this collection.
Its SHA-256 is:
df59333f5c2ff7ff223e7b321575fd86c6d6aaaa86622f84fa9946ecf70204faThe admin sign-in archive of 5 September also matches the preserved file. The SMBC and company announcements have readable copies. Apple’s copy is readable but differs in bytes from the local capture; it is not an identical-file match.
The August code archive does not establish the historical contents of September’s Google response. Each item retains its own date.
The connection now runs company → Clove product → shared official/admin project → admin domain in Google’s configuration. A challenge to that chain should identify the disputed source or inference.
Then ask what the assignment workflow does
The Japan, v2, Hong Kong and two US inventory admin interfaces include assignment scheduling. The Japanese list code implements product selection, checks, submission and result handling. The shared operation definition names scheduleAssignGuaranteedWinOripaUsers. The main article links every regional source.
The surrounding interface also says アド確定オリパ. This call submits oripaIds, identifying pools or products; it does not accept an arbitrary recipient user ID in this operation. Eligibility allocation is therefore a concrete explanation to examine.
System association answers whose systems are connected. Execution records answer what happened. One finding cannot substitute for the other.
Nine possible explanations, examined individually
These are anticipated explanations. Any actual response should be published separately with its wording, date and source.
1. “It is a copy and has nothing to do with us”
“That is not our back room” still needs to explain the matching numbers and address-book entry.
Open the original-source comparison
Copied branding does not explain the entire chain. Shared application configuration and Google’s authorized-domain response require a specific account. Vercel project/team records, domain-change logs and the company’s deployment relationship with developers could resolve ownership and control. A bare denial does not address those records.
2. “It is outsourced, obsolete or a test environment”
If it was an old contractor’s room, show when it was used and whose work it served.
Open the original-source comparison
The admin application references several api.prd.*.clove.jp hosts and shares official project configuration. That makes the environment’s role testable. The label prd alone does not prove production use. Release mappings, deployment dates, routing and traffic records would show its actual role over time.
3. “You edited the screenshots or code”
If someone says a page was replaced, compare the original with copies preserved elsewhere.
Open the original-source comparison
Identify the file and the disputed difference. Readers can compare raw bytes, hashes, recorded sources and third-party replays. Matching archives provide independent comparison points; timestamps bind particular digests. Hashes establish consistency, while timestamps do not endorse an article’s interpretation.
4. “The code was never used”
A task can be in a handbook without being performed. Work records would resolve that.
Open the original-source comparison
The evidence includes a connected interface, candidate-product query, validation, operation call and response handling. Whether it ran still requires resolver versions, job creation/completion records and database history. Integrated code and executed jobs are different findings, each requiring its own evidence.
5. “It only allocates eligibility for normal アド確 products”
If these were only tickets for a special offer, compare the announced entry rules with who received them.
Open the original-source comparison
The context supports examining this explanation seriously. Publish selection rules, eligibility, applicable product IDs, purchase limits, pre-payment disclosures and allocation results. Explain the boundary with ordinary pools. If records show only disclosed promotional eligibility, the conclusion should reflect that. Undisclosed use would raise a different question.
6. “No winners were selected and no paying customer was affected”
A particular customer’s receipt and result must be connected. That complete comparison is not currently available.
Open the original-source comparison
The public evidence does not yet contain a complete transaction chain that directly disproves this. Pool IDs, job IDs, execution times, allocations, payments and outcomes must be matched against the terms shown at purchase. Public data should be anonymized; authorized independent reviewers could examine complete records. A function name does not prove that every player loses.
7. “Account restrictions addressed multiple accounts; no records were destroyed”
Asking someone to leave is different from burning their receipts. Check the reason and whether records remain.
Open the original-source comparison
The official terms provide for account measures in circumstances including multiple accounts. A restriction alone does not establish retaliation or destruction of evidence. A disputed case needs dates, reasons, appeal handling, retention, backups and record-export arrangements. Losing login access does not establish deletion of all server records.
8. “An AI analysis got it wrong”
Read the original rather than trusting the analyst’s name. Correct mistakes and keep checking.
Open the original-source comparison
Analysis is not a substitute for sources. The files here can be checked independently. The earlier attribution of adminSoftDelete to the specified Japanese list file was withdrawn: the string was not found in that file or its decoded historical copy. Correcting that citation leaves the other evidence open to the same scrutiny.
9. “The system has changed”
A new handbook does not rewrite the old one. Compare both by date.
Open the original-source comparison
A new version can change current behavior without rewriting the content previously served. Provide dated releases, the scope of changes and deployment records. A later edit or deletion is not, by itself, an admission, retaliation or proof of manipulated draws.
Download the sources and public analysis
These website editions preserve raw responses and code byte for byte while replacing internal editorial notes with public explanations. DISTRIBUTION.json records preserved, edited and omitted entries. SHA256SUMS.txt covers the files in each new edition.
- Source package: HTTP bodies, JavaScript, WARC and archive receipts
- Identity package: Google configuration, company sources, code context and four recovered files
- Five-language public analysis and verification tools
- Download sizes, SHA-256 digests and signature information
Each new ZIP has its own RFC 3161 timestamp: append .tsr to its filename for the response, or .tsq for the request. Old seals in prior-seals/ cover the original package digests only, not these repackaged ZIPs. The source package also retains an earlier signature covering its original evidence manifest.
Preservation records list 24 readable Wayback source copies and one Archive.today copy of an earlier article. Historical article wording is subject to the current article’s corrections. Twenty Arquivo.pt records await public integration confirmation; the Google-configuration Wayback job remains incomplete, and Perma.cc has no completed receipt. They are not counted as successful archives.
Check the chain yourself
1. Verify the download
Compare the ZIP’s size and SHA-256 with release.json. In Windows PowerShell:
Get-FileHash -Algorithm SHA256 -LiteralPath .\clove-identity-public-20260905.zipAfter extraction, run python verify_files.py from the package root. It checks every entry in SHA256SUMS.txt, reads local files only and does not execute the archived JavaScript.
2. Follow the source records
Use capture-manifest.json in the source package, and additional-public-manifest.json plus identity-chain-sources.json in the identity package. Some Apple, company-announcement and SMBC captures lack saved HTTP headers; the manifest states that limitation rather than inventing a status.
Open both JS files in a text editor. Search for the shared project ID, App ID and authentication domain. Then inspect public-captures/admin-firebase-public-config.json and compare projectId and authorizedDomains with Google’s field definition.
3. Read the operation in context
Search the Japanese list file for scheduleAssignGuaranteedWinOripaUsers, oripaIds, アド確定オリパ and ユーザーの自動割り当て予約. Inspect inputs, candidate products and response handling, then the shared operation definition. The English function name alone omits material context.
The four files in recovered-missing-entries/ match the older manifest’s hashes but were recovered on 5 September. They are not represented as having been present in the original ZIP.
4. Check archive dates and timestamp signatures
A Wayback replay’s 14-digit date is UTC. Follow the actual replay and final URL, then compare the downloaded bytes. A submitted job is not a readable archive, and dynamic HTML differences do not automatically indicate fabrication.
Download the ZIP’s .tsr, the FreeTSA CA certificate and signing certificate into one folder, then run:
openssl ts -verify -data clove-identity-public-20260905.zip -in clove-identity-public-20260905.zip.tsr -CAfile cacert.pem -untrusted tsa.crtSuccess reads Verification: OK. You can obtain certificates independently through FreeTSA’s instructions. Trust rests on that authority and certificate chain; no Bitcoin anchoring is claimed. A timestamp establishes that the signed digest existed by its issue time, not server authorship, draw outcomes or the truth of an allegation.
The next connection is the customer’s transaction
The system-association chain is now available for independent inspection. Rules, allocations, payments, outcomes and account measures for the same products would establish whether customers were affected.
If the records explain the workflow, publish the explanation. If they conflict, identify the conflict. That is the standard this investigation asks of the platform and accepts for itself.
Parrot’s CARDZ.GAME recommendation and referral disclosure remain at the end of the main article. That recommendation adds no weight to evidence against CLOVE and deserves the same scrutiny.