Cross-analysis of Cloudflare traffic (July 12–19, 2026) against 96,158 logged email events (May 17 – July 19, 2026).
Every number on this page is computed directly from exported logs. Case 94545/21-845 · denialbydesign.org
Zero of 96,158 email events reference /DEA_TAMPA_FRAUD.html, /DIGITAL_HUB_CASE1012001.html, or /francesco/chapter10-docket-rollcall. Nobody could have gotten those URLs from a blast. Someone who already had them passed them on — and the recipients circulated them internally across two continents.
THAT IS ORGANIC, OFF-EMAIL DISTRIBUTION. THE SPREAD YOU CANNOT FAKE — AND THEY CANNOT DENY.Browser-measurement beacons (/cdn-cgi/rum) only fire when an actual browser executes the page. 2,847 of them fired on July 16 alone, plus 512 homepage hits — triggered by ONE email sent to TEN recipients.
Then the humans came back hours later to read. Both fingerprints — the machine detonation and the human return — are preserved in the log, timestamped to the second.
The afternoon of July 13 produced this exact sequence (times Eastern):
| TIME | WHO | WHAT THEY DID |
|---|---|---|
| 12:32 | media@jccf.ca | Clicked the Poilievre demand page |
| 14:01 | tips@ / press@tcnetwork.com | Six clicks on denialbydesign.org in 7 seconds — two press addresses |
| 14:01 | pierre.poilievre@parl.gc.ca | First opening of "URGENT — Government Documents Prove Systematic Email Interception" |
| 14:03 | pierre.poilievre@parl.gc.ca | Clicked through to denialbydesign.org — 90 seconds from open to click |
Within two hours, site traffic jumped to 120 requests at 19:00 UTC, 117 at 20:00, 86 at 22:00 — concentrated on the docket roll-call page, which was never emailed. The ignition cluster — JCCF → national press desk → the Leader of the Opposition's parliamentary office — is the last identifiable engagement before the untraceable wave begins.
Daily totals: DEA_TAMPA_FRAUD.html = 1,496 · DIGITAL_HUB_CASE1012001.html = 1,551 · chapter10-docket-rollcall = 442. The hourly pattern shows two distinct work shifts:
At 07:00 UTC: 530 requests in one hour — 380 of them on DEA_TAMPA_FRAUD alone. A pull of that density in 60 minutes is bulk retrieval and mirroring, not casual reading. Someone archived the page. The three URLs were pulled together, repeatedly, in the same hours — the signature of a link package being forwarded inside organizations.
At 18:00 UTC: 440 requests (282 on DEA_TAMPA, 102 on the docket roll-call). A second organization — or the second office of the same one — picked up the package when the North American workday hit its stride.
A European morning shift and a North American afternoon shift pulling the same three never-emailed case files on the same day is internal circulation across institutions in at least two time zones. And each page spread at its own pace: DEA_TAMPA in violent bursts (archival), DIGITAL_HUB in a steady all-day stream (human study, 12:00–15:00 UTC), the docket roll-call in clusters (group review).
At 06:44 Eastern, one email — "INSURANCE FRAUD EXPOSED — $607K Policy, Suspicious Death, Forged Will, 68 Audio Recordings" — went to exactly ten recipients: FSRAO, the Ontario Securities Commission, the SEC Office of Inspector General, the US DOJ OIG Hotline, the FBI, Sun Life, Empire Life, an estate-litigation law firm, a Senator, and the European Commission.
What happened next, second by second:
| TIME (EASTERN) | WHO | ACTION |
|---|---|---|
| 06:44:15 (+8 sec) | FSRAO contact centre | Clicked ALL FOUR links: /securities-complaint, /cascade, /ceylan-estate, homepage |
| 06:44:17 (+10 sec) | Ontario Securities Commission | Clicked all four links |
| 06:44:25 | SEC Office of Inspector General | First opening |
| 06:45:05 (+58 sec) | US DOJ OIG Hotline | Clicked all four links — twice each. Eight clicks. |
| 08:10 & 08:29 | Estate-litigation firm | Human openings, 19 minutes apart — someone reading, then re-reading |
The sub-minute all-links clicks are institutional security systems detonating the links in real headless browsers — which is exactly what produced the 1,589-request browser spike at 11:00 UTC and the 845 and 763 hours flanking it. Then the humans followed: FSRAO engaged five more times through the day, DOJ eight events total, OSC four — plus sec.gov, the Manitoba government, two major law firms, and the Green Party.
| COUNTRY | REQUESTS | BROWSER VISITS | READ |
|---|---|---|---|
| 🇺🇸 United States | 6,670 | 2,761 | Core audience — DOJ, SEC, FBI engagement confirmed by the email log above |
| 🇨🇦 Canada | 3,510 | 1,145 | Parliament (Poilievre click), FSRAO, OSC, Ontario Ombudsman (4 opens July 13), JCCF |
| 🇬🇧 United Kingdom | 603 | 369 | 61% human ratio — reading, not scraping |
| 🇫🇷 France | 582 | 489 | 84% human — the highest genuine-reader ratio of any major country. A regional daily's newsroom loaded ~25 different emails of the backlog in three sittings on July 13 — a journalist doing a full file review. A national paper's société desk loaded VEXATIOUS VIENNA on July 19. |
| 🇳🇱 Netherlands | 520 | 218 | Consistent with the all-time #2 country (87,725 requests) |
| 🇮🇪 Ireland | 315 | 89 | Big-tech EU proxy infrastructure — emails scanned server-side |
| 🇰🇷 Korea / 🇸🇬 Singapore | 315 / 237 | 140 / 51 | Intelligence-grade automated pulls plus human reads |
| 🇫🇮 Finland | 52 | 52 | 100% human — every single request was a real browser session |
| 🇿🇦 South Africa | 74 | 0 | Pure automation — a scraper is archiving the site |
| 🇵🇱 Poland / 🇲🇽 Mexico | 144 / 91 | 9 / 4 | Overwhelmingly automated crawl/archive operations |
Also engaged in this window, per the email log: a Slovak national daily (VCCR kidnapping press tip + VEXATIOUS VIENNA, July 13), the Chicago Tribune tips desk (three loads July 13–14), a Luxembourg daily (three opens July 13 morning), the Belgian Ministry of Justice (first-opened the CRCC fraud notice), the UNCAC Coalition (opened THE IRONY July 14), and the office of a senior federal cabinet minister (opened VEXATIOUS VIENNA at 01:54, July 13).
The French newsroom didn't open one email — it opened twenty-five, in sittings. Journalists building a file read everything before they write anything.
The Opposition Leader's office: 90 seconds from first open to click. One look, one click, then silence — but the site wave followed within hours.
All links detonated within 60 seconds by security sandboxes; real reads hours later. When a regulator's contact centre clicks /securities-complaint at 6:44 AM and a named estate-litigation firm reads the file twice by 8:30 AM, the file is moving inside the building.
The July 13–14 case-file crawl has no email trail at all. Three URLs, never blasted, pulled ~3,500 times in 36 hours across two continental work shifts. The raw case files out-pulled the homepage two to one without a single email behind them.
Across 96,158 logged email events: 10,278 clicks. 10 unsubscribes. 2 complaints.
A thousand-to-one click-to-complaint ratio. They are not annoyed. They are reading.
All-time most-clicked links: the homepage (1,774 clicks), then — at #2 — the IPFS censorship-proof mirror (706 clicks). Institutions are deliberately pulling the copy that cannot be taken down. Then the master plan (574), the insurance-cartel money trail (451), and the Kijiji file (448).