Batch and expiry copied from a real box will already be nearly expired. That is the tell.

You have two changes at once here. You cannot attribute anything until one of them moves.

Sorry, probably obvious, but where do you even start with something blank?

A privacy service registered three months ago on a domain claiming twenty years of trading is a contradiction.

Domain age is one of the few signals that is expensive to fake and free to check.