# Connecting CLOVE’s admin site to its official systems: the evidence, nine questions and how to check

**An unfamiliar admin address can be dismissed as a copy. A screenshot can be disputed. But company publications, official application code, Google’s project configuration and an earlier web archive require a more specific answer.**

Here are the sources behind the investigation. You do not have to accept Parrot’s interpretation to check the files, follow the connections and identify what the records actually establish.

[Read the investigation](/en/guides/clove-scam/) · [Download the evidence](#downloads) · [Check it yourself](#verify)

Evidence reviewed: 5 September 2026. The nine explanations below are prospective questions, **not statements CLOVE has made**.

## Picture a shop, a back room and an address book

There are five checks:

1. **Read the shop’s introduction.** Does the company identify the brand as its service?
2. **Compare department numbers.** Do the shop-front and back-room forms carry the same identifiers?
3. **Check the address book.** Does Google, the system provider, list both addresses together?
4. **Open an older copy.** Does material preserved by somebody else match the file now being examined?
5. **Ask for the work record.** A task in a handbook still needs a log to show when it was performed.

The first four checks have source material you can open. The fifth needs execution and transaction records. **Connecting the shop to its back room does not show who received which prize.**

These are analogies. The actual “address book” is a list of permitted redirect domains, not a property deed or staff register. The original sources follow.

<details>
<summary>Open the original-source comparison</summary>

## Start with the company and the product

[TrustHub’s website](https://trusthub.jp/) lists Clove Oripa as a service and links to `oripa.clove.jp`. [Apple’s Clove listing](https://apps.apple.com/hk/app/clove/id1631035982) names TRUST HUB, K.K. as supplier. A [company-issued announcement](https://prtimes.jp/main/html/rd/p/000000001.000059394.html) and [SMBC’s announcement of 15 October 2024](https://smbc-cf.com/news/data/2024/10/news_20241015.pdf) also connect the business to Clove.

That establishes the company–product link. The admin site requires a separate technical connection.

## The official site and admin sign-in share a project

Compare the [official clove.jp JavaScript](https://clove.jp/_next/static/chunks/pages/_app-087b8d6889c74648.js) with the [admin sign-in JavaScript](https://clv-admn-next.vercel.app/_next/static/chunks/pages/signIn-ac96f3ec7e9b1cbe.js). Both contain these public Firebase identifiers:

| Identifier | Shared value |
| --- | --- |
| Project ID | `clove-v2-prd` |
| App ID | `1:385949280493:web:224ed7999dd0740cfdc4e4` |
| Authentication domain | `clove-v2-prd.firebaseapp.com` |

The public configuration keys also have the same hash; see `identity-chain-sources.json` in the identity package. [Firebase documents](https://firebase.google.com/docs/projects/api-keys) these keys as project identifiers, not admin login credentials.

Public code can be copied. Matching code is therefore the beginning of this connection, not its final step.

## Google’s response includes the admin domain

At approximately 03:56 UTC on 5 September 2026, Google’s public project-configuration endpoint returned HTTP 200 when queried using the public configuration identifier from each application. The two response bodies are byte-identical. Both identify project number `385949280493`.

The `authorizedDomains` array includes `clove.jp`, `oripa.clove.jp` and `clv-admn-next.vercel.app`.

**The connection extends into configuration returned by Google.** An explanation that the admin address is wholly unrelated now has to account for its presence in this project’s authorized-domain list.

[Google defines this field](https://docs.cloud.google.com/identity-platform/docs/reference/rest/v1/TopLevel/getProjects) as domains authorized for widget redirects. It supports a technical configuration link; it does not identify a legal owner, Vercel account holder or operator. IAM records, domain changes and deployment history would establish who controlled each part and when.

The two captured Google JSON files are in `public-captures/`. Their SHA-256 is:

```text
7a574650bdfa74f1460bb31500d691ff8d6a386660b56cfe21239675e936228b
```

## An earlier archive anchors the official code version

[Wayback’s official-JS copy from 23 August 2026 at 02:14:55 UTC](https://web.archive.org/web/20260823021455id_/https://clove.jp/_next/static/chunks/pages/_app-087b8d6889c74648.js) is byte-identical to the official file preserved on 5 September. That code was available before this collection.

Its SHA-256 is:

```text
df59333f5c2ff7ff223e7b321575fd86c6d6aaaa86622f84fa9946ecf70204fa
```

[The admin sign-in archive of 5 September](https://web.archive.org/web/20260905034032id_/https://clv-admn-next.vercel.app/_next/static/chunks/pages/signIn-ac96f3ec7e9b1cbe.js) also matches the preserved file. The SMBC and company announcements have readable copies. Apple’s copy is readable but differs in bytes from the local capture; it is not an identical-file match.

The August code archive does not establish the historical contents of September’s Google response. Each item retains its own date.

The connection now runs **company → Clove product → shared official/admin project → admin domain in Google’s configuration**. A challenge to that chain should identify the disputed source or inference.

## Then ask what the assignment workflow does

The Japan, v2, Hong Kong and two US inventory admin interfaces include assignment scheduling. The [Japanese list code](https://clv-admn-next.vercel.app/_next/static/chunks/pages/oripa/list-0f33ebdda397cc72.js) implements product selection, checks, submission and result handling. The [shared operation definition](https://clv-admn-next.vercel.app/_next/static/chunks/2902-1b4cb7dff6c6ef54.js) names `scheduleAssignGuaranteedWinOripaUsers`. [The main article links every regional source.](/en/guides/clove-scam/)

The surrounding interface also says `アド確定オリパ`. This call submits `oripaIds`, identifying pools or products; it does not accept an arbitrary recipient user ID in this operation. Eligibility allocation is therefore a concrete explanation to examine.

**System association answers whose systems are connected. Execution records answer what happened.** One finding cannot substitute for the other.


</details>

## Nine possible explanations, examined individually

These are anticipated explanations. Any actual response should be published separately with its wording, date and source.

### 1. “It is a copy and has nothing to do with us”

“That is not our back room” still needs to explain the matching numbers and address-book entry.

<details>
<summary>Open the original-source comparison</summary>

Copied branding does not explain the entire chain. Shared application configuration and Google’s authorized-domain response require a specific account. Vercel project/team records, domain-change logs and the company’s deployment relationship with developers could resolve ownership and control. A bare denial does not address those records.

</details>

### 2. “It is outsourced, obsolete or a test environment”

If it was an old contractor’s room, show when it was used and whose work it served.

<details>
<summary>Open the original-source comparison</summary>

The [admin application](https://clv-admn-next.vercel.app/_next/static/chunks/pages/_app-6827489be620db89.js) references several `api.prd.*.clove.jp` hosts and shares official project configuration. That makes the environment’s role testable. The label `prd` alone does not prove production use. Release mappings, deployment dates, routing and traffic records would show its actual role over time.

</details>

### 3. “You edited the screenshots or code”

If someone says a page was replaced, compare the original with copies preserved elsewhere.

<details>
<summary>Open the original-source comparison</summary>

Identify the file and the disputed difference. Readers can compare raw bytes, hashes, recorded sources and third-party replays. Matching archives provide independent comparison points; timestamps bind particular digests. Hashes establish consistency, while timestamps do not endorse an article’s interpretation.

</details>

### 4. “The code was never used”

A task can be in a handbook without being performed. Work records would resolve that.

<details>
<summary>Open the original-source comparison</summary>

The evidence includes a connected interface, candidate-product query, validation, operation call and response handling. Whether it ran still requires resolver versions, job creation/completion records and database history. Integrated code and executed jobs are different findings, each requiring its own evidence.

</details>

### 5. “It only allocates eligibility for normal アド確 products”

If these were only tickets for a special offer, compare the announced entry rules with who received them.

<details>
<summary>Open the original-source comparison</summary>

The context supports examining this explanation seriously. Publish selection rules, eligibility, applicable product IDs, purchase limits, pre-payment disclosures and allocation results. Explain the boundary with ordinary pools. If records show only disclosed promotional eligibility, the conclusion should reflect that. Undisclosed use would raise a different question.

</details>

### 6. “No winners were selected and no paying customer was affected”

A particular customer’s receipt and result must be connected. That complete comparison is not currently available.

<details>
<summary>Open the original-source comparison</summary>

The public evidence does not yet contain a complete transaction chain that directly disproves this. Pool IDs, job IDs, execution times, allocations, payments and outcomes must be matched against the terms shown at purchase. Public data should be anonymized; authorized independent reviewers could examine complete records. A function name does not prove that every player loses.

</details>

### 7. “Account restrictions addressed multiple accounts; no records were destroyed”

Asking someone to leave is different from burning their receipts. Check the reason and whether records remain.

<details>
<summary>Open the original-source comparison</summary>

The [official terms](https://clove.jp/terms) provide for account measures in circumstances including multiple accounts. A restriction alone does not establish retaliation or destruction of evidence. A disputed case needs dates, reasons, appeal handling, retention, backups and record-export arrangements. Losing login access does not establish deletion of all server records.

</details>

### 8. “An AI analysis got it wrong”

Read the original rather than trusting the analyst’s name. Correct mistakes and keep checking.

<details>
<summary>Open the original-source comparison</summary>

Analysis is not a substitute for sources. The files here can be checked independently. The earlier attribution of `adminSoftDelete` to the specified Japanese list file was withdrawn: the string was not found in that file or its decoded historical copy. Correcting that citation leaves the other evidence open to the same scrutiny.

</details>

### 9. “The system has changed”

A new handbook does not rewrite the old one. Compare both by date.

<details>
<summary>Open the original-source comparison</summary>

A new version can change current behavior without rewriting the content previously served. Provide dated releases, the scope of changes and deployment records. A later edit or deletion is not, by itself, an admission, retaliation or proof of manipulated draws.

</details>

<h2 id="downloads">Download the sources and public analysis</h2>

These website editions preserve raw responses and code byte for byte while replacing internal editorial notes with public explanations. `DISTRIBUTION.json` records preserved, edited and omitted entries. `SHA256SUMS.txt` covers the files in each new edition.

- [Source package: HTTP bodies, JavaScript, WARC and archive receipts](/reports/clove-evidence/clove-sources-public-20260905.zip)
- [Identity package: Google configuration, company sources, code context and four recovered files](/reports/clove-evidence/clove-identity-public-20260905.zip)
- [Five-language public analysis and verification tools](/reports/clove-evidence/clove-analysis-public-20260905.zip)
- [Download sizes, SHA-256 digests and signature information](/reports/clove-evidence/release.json)

Each new ZIP has its own RFC 3161 timestamp: append `.tsr` to its filename for the response, or `.tsq` for the request. Old seals in `prior-seals/` cover the original package digests only, **not these repackaged ZIPs**. The source package also retains an earlier signature covering its original evidence manifest.

Preservation records list 24 readable Wayback source copies and [one Archive.today copy of an earlier article](https://archive.md/lYFbI). Historical article wording is subject to the current article’s corrections. Twenty Arquivo.pt records await public integration confirmation; the Google-configuration Wayback job remains incomplete, and Perma.cc has no completed receipt. They are not counted as successful archives.

<h2 id="verify">Check the chain yourself</h2>

### 1. Verify the download

Compare the ZIP’s size and SHA-256 with `release.json`. In Windows PowerShell:

```powershell
Get-FileHash -Algorithm SHA256 -LiteralPath .\clove-identity-public-20260905.zip
```

After extraction, run `python verify_files.py` from the package root. It checks every entry in `SHA256SUMS.txt`, reads local files only and does not execute the archived JavaScript.

### 2. Follow the source records

Use `capture-manifest.json` in the source package, and `additional-public-manifest.json` plus `identity-chain-sources.json` in the identity package. Some Apple, company-announcement and SMBC captures lack saved HTTP headers; the manifest states that limitation rather than inventing a status.

Open both JS files in a text editor. Search for the shared project ID, App ID and authentication domain. Then inspect `public-captures/admin-firebase-public-config.json` and compare `projectId` and `authorizedDomains` with Google’s field definition.

### 3. Read the operation in context

Search the Japanese list file for `scheduleAssignGuaranteedWinOripaUsers`, `oripaIds`, `アド確定オリパ` and `ユーザーの自動割り当て予約`. Inspect inputs, candidate products and response handling, then the shared operation definition. The English function name alone omits material context.

The four files in `recovered-missing-entries/` match the older manifest’s hashes but were recovered on 5 September. They are not represented as having been present in the original ZIP.

### 4. Check archive dates and timestamp signatures

A Wayback replay’s 14-digit date is UTC. Follow the actual replay and final URL, then compare the downloaded bytes. A submitted job is not a readable archive, and dynamic HTML differences do not automatically indicate fabrication.

Download the ZIP’s `.tsr`, the [FreeTSA CA certificate](/reports/clove-evidence/cacert.pem) and [signing certificate](/reports/clove-evidence/tsa.crt) into one folder, then run:

```sh
openssl ts -verify -data clove-identity-public-20260905.zip -in clove-identity-public-20260905.zip.tsr -CAfile cacert.pem -untrusted tsa.crt
```

Success reads `Verification: OK`. You can obtain certificates independently through [FreeTSA’s instructions](https://www.freetsa.org/index_en.php). Trust rests on that authority and certificate chain; no Bitcoin anchoring is claimed. A timestamp establishes that the signed digest existed by its issue time, not server authorship, draw outcomes or the truth of an allegation.

## The next connection is the customer’s transaction

The system-association chain is now available for independent inspection. Rules, allocations, payments, outcomes and account measures for the same products would establish whether customers were affected.

**If the records explain the workflow, publish the explanation. If they conflict, identify the conflict.** That is the standard this investigation asks of the platform and accepts for itself.

Parrot’s CARDZ.GAME recommendation and referral disclosure remain at [the end of the main article](/en/guides/clove-scam/). That recommendation adds no weight to evidence against CLOVE and deserves the same scrutiny.
