-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

COBRA STEALER - SAMPLE DELIVERY ATTESTATION
============================================
Issued: 2026-10-06
Key:    ed25519, verification@cobrastealer.cool

WHAT IS ATTESTED
- - - ----------------

1) SAMPLE BUNDLE SHA-256 (base16, exact order):
     3133a4f2002b5ab69668774ad511eb41447259247ffac30fb1d861416ef070df
   fetch and check:
     curl -sO https://cobrastealer.cool/demo/sample.zip
     sha256sum sample.zip
   the output must match the hash above exactly.

2) TLS CERTIFICATE SHA-256 FINGERPRINT (exactly as openssl prints it):
     4E:73:F6:AD:CB:1C:00:F2:A5:A2:3B:B5:7B:C7:2A:8A:CE:45:C7:EE:15:09:24:8D:E4:0B:59:46:83:73:40:23
   check (paste as one line):
     openssl s_client -connect cobrastealer.cool:443 -servername cobrastealer.cool </dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout
   the output must match the fingerprint above exactly.

3) TOR MIRROR PARITY:
   the onion mirror serves this page byte-identical to clearnet.
   check:
     curl -s -o clearnet.html https://cobrastealer.cool/
     curl --socks5-hostname 127.0.0.1:9050 -s -o onion.html http://cobraywnifehev7qmvksi3hi62xejt7fihorynlvgsy5hxdae63zaxad.onion/
     sha256sum clearnet.html onion.html
   the two hashes must be identical.

4) EXPECTED DELIVERY SHAPE:
   a real forge delivers the same shape as the sample: one plain zip,
   no password, files plus links, with its own sha-256 posted in your
   bot BEFORE release of escrow funds. no hash, no release. that is
   the delivery contract.

5) CONTACT VERIFICATION:
   all official contacts (telegram handle, session id, simplex link)
   are listed only on this page and in the clearsign mirror list:
     gpg --import https://cobrastealer.cool/pgp.txt
     curl -sO https://cobrastealer.cool/mirrors.txt && gpg --verify mirrors.txt
   anything not carrying the signature of
     FE61AEB5AFB0E7BA7BD3C45F904E9C90EA66119E
   is not us.

6) CLEARNET PAGE SHA-256 TODAY (base16, current build):
     012dafa482d0ace245777619905049a9fe4c446488aed5e2e50975a6805dce5d
   changes when the page changes. mirrors.txt and the escrow record
   are the durable anchors; this one lets you diff the page you read
   against the page we signed today.

VERIFY THIS ATTESTATION
- - - -----------------------
   gpg --import https://cobrastealer.cool/pgp.txt
   curl -sO https://cobrastealer.cool/attest.txt && gpg --verify attest.txt
============================================
-----BEGIN PGP SIGNATURE-----

iJUEARYKAD0WIQT+Ya61r7DnunvTxF+QTpyQ6mYRngUCasUmmR8cdmVyaWZpY2F0
aW9uQGNvYnJhc3RlYWxlci5jb29sAAoJEJBOnJDqZhGed0sA/j5MyKL8qDrs+9RR
WDGtjtbT2CnVdxWg3w0WeK3iScf2AQCOmtcOPdMeHbprfV7UB5UKcz7mqMzbKdJK
Bd+ggNI5Cg==
=m29Y
-----END PGP SIGNATURE-----