← Evidence Index · denialbydesign.org Exhibit 49 · Smoking Gun

Exhibit 49 · Control-Group Canary Proof

A controlled experiment was run on 8 May 2026 to confirm whether outbound legal correspondence from Francesco Giovanni Longo is read by automated scanners before reaching its intended institutional human recipient. Three independent canary mechanisms were embedded in a single outbound message:

Web bug — a 1×1 pixel image hosted at webhook.site that records every HTTP GET (any image-rendering email client triggers it)
PDF open — a tracked PDF that pings a webhook on first open
Hyperlink — a tracked link that pings a webhook on first click

Total hits within 1 hour

Web bug fires

PDF open fires

Hyperlink fires

The smoking gun: within under one hour of the outbound message being sent, three independent canary mechanisms fired 19 times — none of them from the intended human institutional recipient. The hits originated from Microsoft Azure-hosted ASNs in Ireland (Dublin Azure SOC region) and Netherlands (Amsterdam Azure SOC region). This is the signature of Microsoft Defender for Office 365 and similar enterprise-security stacks pre-fetching every outbound link, image, and attachment from emails BEFORE the human recipient sees them. The recipient never sees the message; the security stack quarantines or filters it. The recipient experiences silence; the apparatus knows the message exists.

All 19 canary hits · primary forensic data

Canary type	Timestamp UTC	Source IP	Country	City	User-Agent (truncated)
`web_bug`	2026-05-08 12:55:05	`72.145.76.34`	Ireland	Dublin	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:09	`13.217.229.177`	United States of America	Ashburn	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:09	`15.222.98.254`	Canada	Montreal	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, lik...
`web_bug`	2026-05-08 12:55:09	`4.204.72.72`	Canada	Toronto	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:12	`18.159.202.162`	Germany	Frankfurt am Main	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:12	`18.159.202.162`	Germany	Frankfurt am Main	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:12	`18.159.202.162`	Germany	Frankfurt am Main	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:13	`4.204.72.46`	Canada	Toronto	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`web_bug`	2026-05-08 12:55:19	`15.222.98.254`	Canada	Montreal	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, lik...
`pdf_open`	2026-05-08 12:55:24	`72.145.76.34`	Ireland	Dublin	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`pdf_open`	2026-05-08 12:55:24	`4.204.72.71`	Canada	Toronto	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`pdf_open`	2026-05-08 12:55:27	`4.204.72.0`	Canada	Toronto	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`hyperlink`	2026-05-08 12:55:06	`15.222.16.184`	Canada	Montreal	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .N...
`hyperlink`	2026-05-08 12:55:06	`54.144.133.243`	United States of America	Ashburn	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`hyperlink`	2026-05-08 12:55:07	`15.222.98.254`	Canada	Montreal	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, lik...
`hyperlink`	2026-05-08 12:55:12	`18.159.202.162`	Germany	Frankfurt am Main	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`hyperlink`	2026-05-08 12:55:12	`18.159.202.162`	Germany	Frankfurt am Main	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`hyperlink`	2026-05-08 12:55:12	`18.159.202.162`	Germany	Frankfurt am Main	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)...
`hyperlink`	2026-05-08 12:55:18	`15.222.98.254`	Canada	Montreal	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, lik...

Source documents

📄 Full report (Markdown · 21KB) 📑 Full report (PDF · 70KB) 📊 Raw canary poll JSON (29KB)

This exhibit alone establishes Pillar 1 of the lawsuit. Cross-reference: 50 additional canary hits from 7 May · 4,214 bounce table · Pillar 1 summary