A privacy service registered three months ago on a domain claiming twenty years of trading is a contradiction.

Batch and expiry copied from a real box will already be nearly expired. That is the tell.

You have two changes at once here. You cannot attribute anything until one of them moves.

Loose evidence and no evidence are different, and people overcorrect in both directions.