{
    "export_type": "scanapse_domain_dossier",
    "schema_version": "1.0",
    "domain": "0bla.com",
    "measured_at": "2026-09-04T22:03:56+00:00",
    "engine_version": "2.6.2",
    "pattern_version": "2026.09.4",
    "summary": [
        "5 observations publiques sont documentées dans ce dossier.",
        "2 dépendances publiques structurantes sont visibles.",
        "2 évolutions utiles sont retenues depuis la lecture précédente.",
        "2 points restent à confirmer ou ne sont pas observables de l’extérieur."
    ],
    "knowledge_states": {
        "observed": 5,
        "deduced": 0,
        "to_confirm": 0,
        "not_observable": 2,
        "contradictory": 0,
        "untested": 2
    },
    "short_view": [
        {
            "key": "identity_governance",
            "label": "Identité et gouvernance",
            "items": [
                {
                    "id": "3c198f12e89d4db440788104aa696511e3dd26f0cb550bb05a404a4d7496e7c5",
                    "title": "Depends on provider",
                    "value": "Cloudflare",
                    "state": "observed",
                    "state_label": "Observé",
                    "evidence_ids": [
                        "c65dd2899db54c1c547a7081dbbeb53f1ce50af461eb40f6c4412fe2fe2c3069",
                        "ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc",
                        "1c5cf97fe6ac4ac6b506f33800e2b8f17e48e8560656ac00c04ae81bbf2fa297"
                    ],
                    "rationale": "independent_provider_evidence_converges"
                },
                {
                    "id": "7fecb1e367e1d668b4edec2c8ee9253516a33e6a74f28fc526928e26e7b6df48",
                    "title": "Origin host",
                    "value": null,
                    "state": "not_observable",
                    "state_label": "Non observable de l'extérieur",
                    "evidence_ids": [],
                    "rationale": "public_edge_does_not_reveal_origin"
                },
                {
                    "id": "80e3984e179153f476fc34ac31fa4ec8b7427b01b3131a5d84d3908400002055",
                    "title": "Canary detection",
                    "value": null,
                    "state": "untested",
                    "state_label": "Non testé",
                    "evidence_ids": [],
                    "rationale": "canary_detection_not_enabled"
                }
            ],
            "states": {
                "observed": 1,
                "deduced": 0,
                "to_confirm": 0,
                "not_observable": 1,
                "contradictory": 0,
                "untested": 1
            }
        },
        {
            "key": "infrastructure_transport",
            "label": "Infrastructure et transport",
            "items": [
                {
                    "id": "08192ebb6745847c15e028f0e162746a7d7a43b74a0d94dc01e54ff8ad500533",
                    "title": "Tls issuer",
                    "value": "C = US, O = Let's Encrypt, CN = YE2",
                    "state": "observed",
                    "state_label": "Observé",
                    "evidence_ids": [
                        "21dc11d89d8c1177c7a4e18ac8c4b905a4fca9242ff6045007de2a89f31cc7eb"
                    ],
                    "rationale": "certificate_observed"
                },
                {
                    "id": "a8355749e1fb86be9ec924da71a14973ca5a7a445815f753f5766dc6872394f6",
                    "title": "Post quantum tls",
                    "value": null,
                    "state": "untested",
                    "state_label": "Non testé",
                    "evidence_ids": [],
                    "rationale": "pq_tls_client_not_enabled"
                }
            ],
            "states": {
                "observed": 1,
                "deduced": 0,
                "to_confirm": 0,
                "not_observable": 0,
                "contradictory": 0,
                "untested": 1
            }
        },
        {
            "key": "mail_trust",
            "label": "Messagerie et confiance",
            "items": [
                {
                    "id": "b5600f6330260338c2fdfa44f210c49a8337e0b511dd6a40de96742d2043a778",
                    "title": "Dmarc policy",
                    "value": "reject",
                    "state": "observed",
                    "state_label": "Observé",
                    "evidence_ids": [
                        "d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4"
                    ],
                    "rationale": "mail_policy_observed"
                },
                {
                    "id": "efc6915103c4c73350ac51829c1e23bf1911720cf15e8ff840d88d06c4016cf2",
                    "title": "Spf policy",
                    "value": "hardfail",
                    "state": "observed",
                    "state_label": "Observé",
                    "evidence_ids": [
                        "b96af84d3df776bf9533e24e351a6bb00667b7eabe09fd90334b87eafdddf360"
                    ],
                    "rationale": "mail_policy_observed"
                }
            ],
            "states": {
                "observed": 2,
                "deduced": 0,
                "to_confirm": 0,
                "not_observable": 0,
                "contradictory": 0,
                "untested": 0
            }
        },
        {
            "key": "dependencies_exposure",
            "label": "Dépendances et exposition",
            "items": [
                {
                    "id": "6220cd514baaf68f32dccce08eaf7308d4173677b6ec03d6036c25750e8eea04",
                    "title": "Depends on provider",
                    "value": "Infomaniak",
                    "state": "observed",
                    "state_label": "Observé",
                    "evidence_ids": [
                        "1e0e4c2e7194c71cacc567eaaaf27145eae61b010f85458201f63823d2b0949f"
                    ],
                    "rationale": "provider_observed_once"
                },
                {
                    "id": "da7e5f4acf46abc22f169289be4231d5af85400e70abca1e6b337fc620774d12",
                    "title": "Data location",
                    "value": null,
                    "state": "not_observable",
                    "state_label": "Non observable de l'extérieur",
                    "evidence_ids": [],
                    "rationale": "provider_metadata_does_not_prove_processing_location"
                }
            ],
            "states": {
                "observed": 1,
                "deduced": 0,
                "to_confirm": 0,
                "not_observable": 1,
                "contradictory": 0,
                "untested": 0
            }
        }
    ],
    "timeline": {
        "first_observed_at": "2026-09-04T19:31:16+00:00",
        "last_observed_at": "2026-09-04T22:03:56+00:00",
        "reference_state": "compared",
        "message": "Comparé à la lecture précédente conservée",
        "counts": {
            "appeared": 0,
            "modified": 2,
            "stable": 39,
            "disappeared": 0
        },
        "meaningful_change_count": 2,
        "change_summary": {
            "appeared": 0,
            "modified": 2,
            "disappeared": 0,
            "stable": 39,
            "meaningful": 2,
            "volatile_filtered": 0,
            "unresolved": 0
        },
        "changes": [
            {
                "status": "modified",
                "label": "Modifié",
                "title": "Http header",
                "before": [
                    "default-src 'none'; script-src 'self' 'nonce-+nj/nRRRO8JJ39+nzfqQlA=='; style-src 'self' 'nonce-+nj/nRRRO8JJ39+nzfqQlA=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
                ],
                "after": [
                    "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
                ],
                "direction": "indeterminate"
            },
            {
                "status": "modified",
                "label": "Modifié",
                "title": "Module finding",
                "before": {
                    "evidence": {
                        "provider": "Cloudflare",
                        "share": 75
                    },
                    "severity": "medium"
                },
                "after": {
                    "evidence": {
                        "provider": "Cloudflare",
                        "share": 75
                    },
                    "severity": "medium"
                },
                "direction": "indeterminate"
            }
        ],
        "history_count": 2
    },
    "observations": [
        {
            "id": "01ab80dc6727dc0fa12ba0e19b2a49a3b4833c69caa148ac08fe5d52809baeef",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issue",
                "value": "ssl.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "092b99ea9e0c8dacab41fb6d2b04a025637e4bf0d70c549638c1c054ad3f8265",
            "type": "tls_valid_to",
            "subject": "0bla.com",
            "predicate": "valid_to",
            "value": "2026-11-14T14:07:24+00:00",
            "source": "tls_valid_to",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "0a245c6902f0830d9777c86e0759256c1296210fd2d9052e865368dc6b64745e",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "mail_trust:mail_single_mx",
            "value": {
                "evidence": [
                    {
                        "host": "mta-gw.infomaniak.ch",
                        "priority": 5
                    }
                ],
                "severity": "low"
            },
            "source": "finding_mail_single_mx",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "0cc9bc390a4df5fa6c04f94e5f7e74d8146dc9d3305511a1793851953b81c502",
            "type": "dns_address",
            "subject": "0bla.com",
            "predicate": "resolves_to",
            "value": "2606:4700:3031::ac43:831e",
            "source": "dns_aaaa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "1334543dc80ec767381ee2341ff772fef3ba60f3a248919066cbc7d3e88e17de",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "iodef",
                "value": "mailto:security@0bla.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "195e0057508225067e867d3ce451cb09d1dc03cc0ff056bd79c4bfa13778121d",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "dns:dns_single_provider",
            "value": {
                "evidence": [
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "severity": "low"
            },
            "source": "finding_dns_single_provider",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "25e63a148519a0c6e70f766059adb1e3e2f048763b972e5eff95d81d7fea766a",
            "type": "dns_address",
            "subject": "0bla.com",
            "predicate": "resolves_to",
            "value": "172.67.131.30",
            "source": "dns_a",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "2c2c76fd5550d85fdaa06fb15ffb8b5760e78cdcf18d4db3ddd815d7ee67603a",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "strict-transport-security",
            "value": [
                "max-age=63072000; includeSubDomains; preload"
            ],
            "source": "header_strict-transport-security",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "30b32db6f12cc199e64be4d57fdc544d8508badabe572a984fb861cbf3452aec",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issuewild",
                "value": "pki.goog; cansignhttpexchanges=yes"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "31076a38061eb86036f6196fb06236672291ef7a64f362b7d83a2cf1e071d9b0",
            "type": "mail_exchanger",
            "subject": "0bla.com",
            "predicate": "uses_mail_exchanger",
            "value": "mta-gw.infomaniak.ch",
            "source": "dns_mx",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "342df1419820ed7c3f130062e633f9d9a5f2bdd1f8f386f3d8c25a40ca51731a",
            "type": "dependency_provider",
            "subject": "0bla.com",
            "predicate": "depends_on_provider",
            "value": {
                "critical": true,
                "hosts": [
                    "cloudflare.com",
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "id": "cloudflare",
                "known": true,
                "name": "Cloudflare",
                "observation_count": 3,
                "services": [
                    "cdn",
                    "security"
                ],
                "tracker": false
            },
            "source": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "46751715d441952495a9b03c572f3d6e0bf3714cce379ada11b1e59cc715c38f",
            "type": "dependency_provider",
            "subject": "0bla.com",
            "predicate": "depends_on_provider",
            "value": {
                "critical": false,
                "hosts": [
                    "mta-gw.infomaniak.ch"
                ],
                "id": "infomaniak",
                "known": true,
                "name": "Infomaniak",
                "observation_count": 1,
                "services": [
                    "dns",
                    "hosting",
                    "mail"
                ],
                "tracker": false
            },
            "source": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "510b5cd36ca6deb3460f2c54f152f7116ecea16c3c571b686f8d22e3fe985af1",
            "type": "dmarc_policy",
            "subject": "0bla.com",
            "predicate": "dmarc_policy",
            "value": "reject",
            "source": "mail_dmarc_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "510d8d9236a465364bad76aed6a938b64d0ca1afb5ffe44704b92d24c0520e1a",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "cross-origin-opener-policy",
            "value": [
                "same-origin"
            ],
            "source": "header_cross-origin-opener-policy",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "52aad5340686585d5de92696480cf3cd07762fe5691e932797dd292cf2c69403",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issuewild",
                "value": "ssl.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "54e5de4cac7cd65a4e47b49f0d81b05160641348285173d62c8783e057b19daf",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issuewild",
                "value": "letsencrypt.org"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "597536ca19b7e8290349aee57c614efda7aad21313b76cbac6a6a12713cd9749",
            "type": "mail_policy_flag",
            "subject": "0bla.com",
            "predicate": "bimi_declared",
            "value": false,
            "source": "mail_bimi_declared",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6026b05133e9c7491767d487c5566073c16379712ad6b1328098113739617419",
            "type": "tls_issuer",
            "subject": "0bla.com",
            "predicate": "issuer",
            "value": "C = US, O = Let's Encrypt, CN = YE2",
            "source": "tls_issuer",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6a3a433395f1b01f8d2229d5530a4ddf9bbecbe951cb5751782136d5e9c6d071",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "dns:dnssec_not_tested",
            "value": {
                "evidence": {
                    "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
                    "status": "not_tested"
                },
                "severity": "info"
            },
            "source": "finding_dnssec_not_tested",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6b2480b819c42928348f15459e0bd296dca0ef3f039d02f469d0a056682e273d",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issuewild",
                "value": "digicert.com; cansignhttpexchanges=yes"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6c4fb719756bcca7f94388b4addb38bc8be32a47a2968703556fa325c86501bc",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "mail_trust:mail_tls_rpt_missing",
            "value": {
                "evidence": null,
                "severity": "low"
            },
            "source": "finding_mail_tls_rpt_missing",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6d6de54afa95621934aad639fe43ec8a486aa0dc52d7502b5d8f3428c1df560c",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issue",
                "value": "pki.goog; cansignhttpexchanges=yes"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "7ab80510c77db4259c11dc2e49ae76ee964efa601dc2676c115ab0fba6e74677",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issue",
                "value": "digicert.com; cansignhttpexchanges=yes"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "7f151a5741365cacf6e592da353cf130a1e74c3826a3423d8c6a4ef19fa736c9",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "x-frame-options",
            "value": [
                "DENY"
            ],
            "source": "header_x-frame-options",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "86888108d586bf51296ba2a406b468e5420d5ef2e2843ba7d3a66aeda35005f4",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "permissions-policy",
            "value": [
                "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
            ],
            "source": "header_permissions-policy",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "86a9bf06915b0b346b7c6783764572549070255bcede4ebd9aec787841ab91e0",
            "type": "technology",
            "subject": "0bla.com",
            "predicate": "uses_technology",
            "value": {
                "name": "cloudflare",
                "version": "",
                "version_exposed": false
            },
            "source": "technology_detected",
            "collector": "technology",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "87ee1f1223eb715429e927df2af26a3e1e5b4b87cd58bfd0d902c0dec09d7c97",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issue",
                "value": "sectigo.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "880788e18d04f516b7a45c71657ee146556b3b932618c87538217add62185c43",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "mail_trust:mail_mta_sts_missing",
            "value": {
                "evidence": null,
                "severity": "low"
            },
            "source": "finding_mail_mta_sts_missing",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "893a5c9c5816aab040d79288015b1cfcb976d147794ec9c3d46a139082aa7d46",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "resilience:dns_concentration",
            "value": {
                "evidence": [
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "severity": "medium"
            },
            "source": "finding_dns_concentration",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "8fe8a758154c45e7e1ffd8851c33f4cfd76aa052afed4dff04ab2aaec46e6f0c",
            "type": "spf_policy",
            "subject": "0bla.com",
            "predicate": "spf_policy",
            "value": "hardfail",
            "source": "mail_spf_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "921790d2d2a0361dd6a0da6dae32f3cf5017efc5f5fc2ad047d1f453ac9258da",
            "type": "dns_address",
            "subject": "0bla.com",
            "predicate": "resolves_to",
            "value": "104.21.9.251",
            "source": "dns_a",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "92c0befa7856981ce21b815150c4aae70451dcbcff6aa8a998c1942f5193400a",
            "type": "dmarc_record",
            "subject": "0bla.com",
            "predicate": "publishes_dmarc",
            "value": "v=DMARC1; p=reject;",
            "source": "dns_dmarc",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "a156676504ca4b8553d53c647797be09d2c4ab1726eee5f4358afbdd1b005fd4",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "content-security-policy",
            "value": [
                "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
            ],
            "source": "header_content-security-policy",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "afc74aeed34d5fe6862033eef48e36ccab98f345256d7011929ae5a3624723a8",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "cross-origin-resource-policy",
            "value": [
                "same-origin"
            ],
            "source": "header_cross-origin-resource-policy",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "b42b0e10a918204e4bb2035c65a0337f60130770938272fc1ea942060c95f3a2",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issuewild",
                "value": "comodoca.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "c86af7b484b5bbc04599deab1b17cc489c9e64e6f3966654e58a9c23f7a7ffad",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "x-content-type-options",
            "value": [
                "nosniff"
            ],
            "source": "header_x-content-type-options",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "cac628424193913c332bc48a4827f81b9cbff91e794a18e0489bf0adf350b118",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "resilience:provider_dominance",
            "value": {
                "evidence": {
                    "provider": "Cloudflare",
                    "share": 75
                },
                "severity": "medium"
            },
            "source": "finding_provider_dominance",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "cd99134712a4c94d6d07ec6f3fbe94a48af7a329dd77bc82e8d65452d3148572",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "dependencies:dependency_concentration",
            "value": {
                "evidence": "75%",
                "severity": "medium"
            },
            "source": "finding_dependency_concentration",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ce708b5c571bcf56a606ae2a9feb89d9451f0161a92a3f53454175eb5c5bc424",
            "type": "dns_nameserver",
            "subject": "0bla.com",
            "predicate": "uses_nameserver",
            "value": "david.ns.cloudflare.com",
            "source": "dns_ns",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d17a5085567ad0751a5c5b52b406d9da5ef55b3f6687a061c517a8a6f40ef670",
            "type": "mail_policy_flag",
            "subject": "0bla.com",
            "predicate": "tls_reporting",
            "value": false,
            "source": "mail_tls_reporting",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d630f9f05ccceaf1c606cd38da4e5cba1ab6e57bf6a515c43371fc9269606a02",
            "type": "mail_policy_flag",
            "subject": "0bla.com",
            "predicate": "mta_sts_declared",
            "value": false,
            "source": "mail_mta_sts_declared",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d7d978e4fb09a3f5f528df36bc5245d2bddb3d95ba6742b4db8bd7ab3b01d6bd",
            "type": "cookie",
            "subject": "0bla.com",
            "predicate": "sets_cookie",
            "value": {
                "http_only": true,
                "name": "id",
                "same_site": "lax",
                "secure": true
            },
            "source": "privacy_cookie",
            "collector": "privacy",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d97eb421d6d054adc1f241dbf24f0d69b0b88bbfa226ae098a853768bf0a3721",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issue",
                "value": "letsencrypt.org"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d9e3d2fbd70a8ba0c2d0a4eca46cd346a72f285e244fbbf3e44f075806d796a7",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "server",
            "value": [
                "cloudflare"
            ],
            "source": "header_server",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ddbb71abc531b9cb0bf88f692feaf91cf08b49b6342d039a63519b16cfbfdfd8",
            "type": "dns_address",
            "subject": "0bla.com",
            "predicate": "resolves_to",
            "value": "2606:4700:3032::6815:9fb",
            "source": "dns_aaaa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "dde2a4816fd6dbbcc68d8e147aaf14dcbea1faf9c0571a3a6ece4123ee568993",
            "type": "spf_record",
            "subject": "0bla.com",
            "predicate": "publishes_spf",
            "value": "v=spf1 include:spf.infomaniak.ch -all",
            "source": "dns_spf",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "dfeea6ea4cb82cabd90aa8f1a3fa62068db5f63846b287f379189d5ab7be69dc",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issue",
                "value": "comodoca.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "eaf480c2db932d3599611497c4bdb03623c4302a4cd8641d82e40ea0c1bc8f14",
            "type": "dns_nameserver",
            "subject": "0bla.com",
            "predicate": "uses_nameserver",
            "value": "thea.ns.cloudflare.com",
            "source": "dns_ns",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ebd67af0a0a30217eff5159a04df4666e6cbddb96074194da864865ce9461565",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "referrer-policy",
            "value": [
                "strict-origin-when-cross-origin"
            ],
            "source": "header_referrer-policy",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ef5c19d00e9792324d25702e7f705a61d0e076815faa063b4393d679082f2618",
            "type": "http_header",
            "subject": "0bla.com",
            "predicate": "cross-origin-embedder-policy",
            "value": [
                "require-corp"
            ],
            "source": "header_cross-origin-embedder-policy",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "f489a968bc139417e564227641fb54b6cd347aebd97671a0f1412c313d386ee2",
            "type": "caa_record",
            "subject": "0bla.com",
            "predicate": "publishes_caa",
            "value": {
                "flags": 0,
                "tag": "issuewild",
                "value": "sectigo.com"
            },
            "source": "dns_caa",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "fe36983fb3249e350f07355b82e8b3f143ea84308748205089c63a9c3d754798",
            "type": "module_finding",
            "subject": "0bla.com",
            "predicate": "sovereignty:outside_europe",
            "value": {
                "evidence": [
                    "Cloudflare"
                ],
                "severity": "high"
            },
            "source": "finding_outside_europe",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "observed_at": "2026-09-04T22:03:56+00:00"
        }
    ],
    "claims": [
        {
            "id": "08192ebb6745847c15e028f0e162746a7d7a43b74a0d94dc01e54ff8ad500533",
            "subject": "0bla.com",
            "predicate": "tls_issuer",
            "value": "C = US, O = Let's Encrypt, CN = YE2",
            "state": "observed",
            "rationale": "certificate_observed",
            "evidence_ids": [
                "21dc11d89d8c1177c7a4e18ac8c4b905a4fca9242ff6045007de2a89f31cc7eb"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "3c198f12e89d4db440788104aa696511e3dd26f0cb550bb05a404a4d7496e7c5",
            "subject": "0bla.com",
            "predicate": "depends_on_provider",
            "value": "Cloudflare",
            "state": "corroborated",
            "rationale": "independent_provider_evidence_converges",
            "evidence_ids": [
                "c65dd2899db54c1c547a7081dbbeb53f1ce50af461eb40f6c4412fe2fe2c3069",
                "ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc",
                "1c5cf97fe6ac4ac6b506f33800e2b8f17e48e8560656ac00c04ae81bbf2fa297"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "6220cd514baaf68f32dccce08eaf7308d4173677b6ec03d6036c25750e8eea04",
            "subject": "0bla.com",
            "predicate": "depends_on_provider",
            "value": "Infomaniak",
            "state": "observed",
            "rationale": "provider_observed_once",
            "evidence_ids": [
                "1e0e4c2e7194c71cacc567eaaaf27145eae61b010f85458201f63823d2b0949f"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "7fecb1e367e1d668b4edec2c8ee9253516a33e6a74f28fc526928e26e7b6df48",
            "subject": "0bla.com",
            "predicate": "origin_host",
            "value": null,
            "state": "unknown",
            "rationale": "public_edge_does_not_reveal_origin",
            "evidence_ids": [],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "80e3984e179153f476fc34ac31fa4ec8b7427b01b3131a5d84d3908400002055",
            "subject": "0bla.com",
            "predicate": "canary_detection",
            "value": null,
            "state": "untested",
            "rationale": "canary_detection_not_enabled",
            "evidence_ids": [],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "a8355749e1fb86be9ec924da71a14973ca5a7a445815f753f5766dc6872394f6",
            "subject": "0bla.com",
            "predicate": "post_quantum_tls",
            "value": null,
            "state": "untested",
            "rationale": "pq_tls_client_not_enabled",
            "evidence_ids": [],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "b5600f6330260338c2fdfa44f210c49a8337e0b511dd6a40de96742d2043a778",
            "subject": "0bla.com",
            "predicate": "dmarc_policy",
            "value": "reject",
            "state": "observed",
            "rationale": "mail_policy_observed",
            "evidence_ids": [
                "d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "da7e5f4acf46abc22f169289be4231d5af85400e70abca1e6b337fc620774d12",
            "subject": "0bla.com",
            "predicate": "data_location",
            "value": null,
            "state": "unknown",
            "rationale": "provider_metadata_does_not_prove_processing_location",
            "evidence_ids": [],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        },
        {
            "id": "efc6915103c4c73350ac51829c1e23bf1911720cf15e8ff840d88d06c4016cf2",
            "subject": "0bla.com",
            "predicate": "spf_policy",
            "value": "hardfail",
            "state": "observed",
            "rationale": "mail_policy_observed",
            "evidence_ids": [
                "b96af84d3df776bf9533e24e351a6bb00667b7eabe09fd90334b87eafdddf360"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00",
            "active": true
        }
    ],
    "evidence": [
        {
            "id": "88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597",
            "observation_ids": [
                "01ab80dc6727dc0fa12ba0e19b2a49a3b4833c69caa148ac08fe5d52809baeef"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "ssl.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "adc9a815da67d5f82ae7e399d086a871229c59b5b0ad39f17ae7da745f6bc93a",
            "observation_ids": [
                "092b99ea9e0c8dacab41fb6d2b04a025637e4bf0d70c549638c1c054ad3f8265"
            ],
            "evidence_type": "tls_valid_to",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "excerpt": "2026-11-14T14:07:24+00:00",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd",
            "observation_ids": [
                "0a245c6902f0830d9777c86e0759256c1296210fd2d9052e865368dc6b64745e"
            ],
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": [
                    {
                        "host": "mta-gw.infomaniak.ch",
                        "priority": 5
                    }
                ],
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1",
            "observation_ids": [
                "0cc9bc390a4df5fa6c04f94e5f7e74d8146dc9d3305511a1793851953b81c502"
            ],
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "2606:4700:3031::ac43:831e",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b",
            "observation_ids": [
                "1334543dc80ec767381ee2341ff772fef3ba60f3a248919066cbc7d3e88e17de"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "iodef",
                "value": "mailto:security@0bla.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3",
            "observation_ids": [
                "195e0057508225067e867d3ce451cb09d1dc03cc0ff056bd79c4bfa13778121d"
            ],
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": [
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448",
            "observation_ids": [
                "25e63a148519a0c6e70f766059adb1e3e2f048763b972e5eff95d81d7fea766a"
            ],
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "172.67.131.30",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298",
            "observation_ids": [
                "2c2c76fd5550d85fdaa06fb15ffb8b5760e78cdcf18d4db3ddd815d7ee67603a"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "max-age=63072000; includeSubDomains; preload"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8",
            "observation_ids": [
                "30b32db6f12cc199e64be4d57fdc544d8508badabe572a984fb861cbf3452aec"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "pki.goog; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d",
            "observation_ids": [
                "31076a38061eb86036f6196fb06236672291ef7a64f362b7d83a2cf1e071d9b0"
            ],
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "mta-gw.infomaniak.ch",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "c65dd2899db54c1c547a7081dbbeb53f1ce50af461eb40f6c4412fe2fe2c3069",
            "observation_ids": [
                "342df1419820ed7c3f130062e633f9d9a5f2bdd1f8f386f3d8c25a40ca51731a"
            ],
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "excerpt": {
                "critical": true,
                "hosts": [
                    "cloudflare.com",
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "id": "cloudflare",
                "known": true,
                "name": "Cloudflare",
                "observation_count": 3,
                "services": [
                    "cdn",
                    "security"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "1e0e4c2e7194c71cacc567eaaaf27145eae61b010f85458201f63823d2b0949f",
            "observation_ids": [
                "46751715d441952495a9b03c572f3d6e0bf3714cce379ada11b1e59cc715c38f"
            ],
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "excerpt": {
                "critical": false,
                "hosts": [
                    "mta-gw.infomaniak.ch"
                ],
                "id": "infomaniak",
                "known": true,
                "name": "Infomaniak",
                "observation_count": 1,
                "services": [
                    "dns",
                    "hosting",
                    "mail"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4",
            "observation_ids": [
                "510b5cd36ca6deb3460f2c54f152f7116ecea16c3c571b686f8d22e3fe985af1"
            ],
            "evidence_type": "dmarc_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": "reject",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018",
            "observation_ids": [
                "510d8d9236a465364bad76aed6a938b64d0ca1afb5ffe44704b92d24c0520e1a"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "same-origin"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95",
            "observation_ids": [
                "52aad5340686585d5de92696480cf3cd07762fe5691e932797dd292cf2c69403"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "ssl.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f",
            "observation_ids": [
                "54e5de4cac7cd65a4e47b49f0d81b05160641348285173d62c8783e057b19daf"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "letsencrypt.org"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "7ee4b64795ef4a6e6534952234b96bd9f56d21c6ca4b048cfaffaad7f494f390",
            "observation_ids": [
                "597536ca19b7e8290349aee57c614efda7aad21313b76cbac6a6a12713cd9749"
            ],
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": false,
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "21dc11d89d8c1177c7a4e18ac8c4b905a4fca9242ff6045007de2a89f31cc7eb",
            "observation_ids": [
                "6026b05133e9c7491767d487c5566073c16379712ad6b1328098113739617419"
            ],
            "evidence_type": "tls_issuer",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "excerpt": "C = US, O = Let's Encrypt, CN = YE2",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491",
            "observation_ids": [
                "6a3a433395f1b01f8d2229d5530a4ddf9bbecbe951cb5751782136d5e9c6d071"
            ],
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": {
                    "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
                    "status": "not_tested"
                },
                "severity": "info"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc",
            "observation_ids": [
                "6b2480b819c42928348f15459e0bd296dca0ef3f039d02f469d0a056682e273d"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "digicert.com; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf",
            "observation_ids": [
                "6c4fb719756bcca7f94388b4addb38bc8be32a47a2968703556fa325c86501bc"
            ],
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e",
            "observation_ids": [
                "6d6de54afa95621934aad639fe43ec8a486aa0dc52d7502b5d8f3428c1df560c"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "pki.goog; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56",
            "observation_ids": [
                "7ab80510c77db4259c11dc2e49ae76ee964efa601dc2676c115ab0fba6e74677"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "digicert.com; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9",
            "observation_ids": [
                "7f151a5741365cacf6e592da353cf130a1e74c3826a3423d8c6a4ef19fa736c9"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "DENY"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "4eb279513f07f7ffaf2d19b40322bf2a5fe70ee7860a7e2dc2316155e07e36f7",
            "observation_ids": [
                "86888108d586bf51296ba2a406b468e5420d5ef2e2843ba7d3a66aeda35005f4"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d9c070d8aabd6091d2da9921501fcbd55f28197b7172fa9b902163b8bae4c911",
            "observation_ids": [
                "86a9bf06915b0b346b7c6783764572549070255bcede4ebd9aec787841ab91e0"
            ],
            "evidence_type": "technology",
            "collector": "technology",
            "rule_version": "2026.09.4",
            "excerpt": {
                "name": "cloudflare",
                "version": "",
                "version_exposed": false
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8",
            "observation_ids": [
                "87ee1f1223eb715429e927df2af26a3e1e5b4b87cd58bfd0d902c0dec09d7c97"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "sectigo.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "59eb97e829254deb99b459244fcc2d3a5a8961d624a02a8bfc9c4108494b6593",
            "observation_ids": [
                "880788e18d04f516b7a45c71657ee146556b3b932618c87538217add62185c43"
            ],
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "62d1cae4295ebafc158cfdf3376b5df32792020e351bd313facf36ed682860e8",
            "observation_ids": [
                "893a5c9c5816aab040d79288015b1cfcb976d147794ec9c3d46a139082aa7d46"
            ],
            "evidence_type": "module_finding",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": [
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "b96af84d3df776bf9533e24e351a6bb00667b7eabe09fd90334b87eafdddf360",
            "observation_ids": [
                "8fe8a758154c45e7e1ffd8851c33f4cfd76aa052afed4dff04ab2aaec46e6f0c"
            ],
            "evidence_type": "spf_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": "hardfail",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "c099f90048a3e5a61db9d52ebb13caf086f7f50cbab2c492dce69514be0a74d0",
            "observation_ids": [
                "921790d2d2a0361dd6a0da6dae32f3cf5017efc5f5fc2ad047d1f453ac9258da"
            ],
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "104.21.9.251",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "149e0762b4d1aef0ca24356cbdec1d5e744d64c8e802f7503e718dbb6e5de490",
            "observation_ids": [
                "92c0befa7856981ce21b815150c4aae70451dcbcff6aa8a998c1942f5193400a"
            ],
            "evidence_type": "dmarc_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "v=DMARC1; p=reject;",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d26139656facab0d01e620bb2e116538d8f2d04c27a44fe8c9456bc1b65dd1fe",
            "observation_ids": [
                "a156676504ca4b8553d53c647797be09d2c4ab1726eee5f4358afbdd1b005fd4"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "5016f5635b4c25f714994c29cb61d9fa510681318c77f419c45b5155a2037a40",
            "observation_ids": [
                "afc74aeed34d5fe6862033eef48e36ccab98f345256d7011929ae5a3624723a8"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "same-origin"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "63f8b030f669d39f019fb867caec7a28532ce4831c40d252909046a3c8b84e6a",
            "observation_ids": [
                "b42b0e10a918204e4bb2035c65a0337f60130770938272fc1ea942060c95f3a2"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "comodoca.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "f0894a119cef6eef2b09badecadc47b6cb754099b0bb94cfeb181b2b1af40cf2",
            "observation_ids": [
                "c86af7b484b5bbc04599deab1b17cc489c9e64e6f3966654e58a9c23f7a7ffad"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "nosniff"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "b0ad5a58e67d2bdbbca7a0340d53653b2c5bf49be88dac2dbfdefcd58f6cae24",
            "observation_ids": [
                "cac628424193913c332bc48a4827f81b9cbff91e794a18e0489bf0adf350b118"
            ],
            "evidence_type": "module_finding",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": {
                    "provider": "Cloudflare",
                    "share": 75
                },
                "severity": "medium"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "8ccbaadfcc6c918d5e778066343b1db4b87a37f7aeddf4b9678b404abfd606f0",
            "observation_ids": [
                "cd99134712a4c94d6d07ec6f3fbe94a48af7a329dd77bc82e8d65452d3148572"
            ],
            "evidence_type": "module_finding",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": "75%",
                "severity": "medium"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc",
            "observation_ids": [
                "ce708b5c571bcf56a606ae2a9feb89d9451f0161a92a3f53454175eb5c5bc424"
            ],
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "david.ns.cloudflare.com",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "2c96bf79009e3da0b26f3bb242714bf8688dff9bea0ee98e716456d332021d44",
            "observation_ids": [
                "d17a5085567ad0751a5c5b52b406d9da5ef55b3f6687a061c517a8a6f40ef670"
            ],
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": false,
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "5e9521ede080a1c057f28385fac51c9179b8ae24348d0b33ae40f29ff0c7aedb",
            "observation_ids": [
                "d630f9f05ccceaf1c606cd38da4e5cba1ab6e57bf6a515c43371fc9269606a02"
            ],
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "excerpt": false,
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "6e1b6642ae0be1b699f94701ae4f8dc33cc4fa8ecd952afff450941b7286f16f",
            "observation_ids": [
                "d7d978e4fb09a3f5f528df36bc5245d2bddb3d95ba6742b4db8bd7ab3b01d6bd"
            ],
            "evidence_type": "cookie",
            "collector": "privacy",
            "rule_version": "2026.09.4",
            "excerpt": {
                "http_only": true,
                "name": "id",
                "same_site": "lax",
                "secure": true
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "2fe58c9ddf755f8e208dc5110e3a161a125ce466a0b39ed5f95fd80be46d65d5",
            "observation_ids": [
                "d97eb421d6d054adc1f241dbf24f0d69b0b88bbfa226ae098a853768bf0a3721"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "letsencrypt.org"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "e75648c3a622b5ec3d1b9e870a914226c3172852862e8a91dbeeb8eb37ad35f9",
            "observation_ids": [
                "d9e3d2fbd70a8ba0c2d0a4eca46cd346a72f285e244fbbf3e44f075806d796a7"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "cloudflare"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "648edc8155510db097dbcd3755bfc96f81f7eac7bc035edb2473d3f0c534aff2",
            "observation_ids": [
                "ddbb71abc531b9cb0bf88f692feaf91cf08b49b6342d039a63519b16cfbfdfd8"
            ],
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "2606:4700:3032::6815:9fb",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "efb500af6db39365bf96852e04c914f70f4c2d094686882c00d67e4523eaad71",
            "observation_ids": [
                "dde2a4816fd6dbbcc68d8e147aaf14dcbea1faf9c0571a3a6ece4123ee568993"
            ],
            "evidence_type": "spf_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "v=spf1 include:spf.infomaniak.ch -all",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "1026f34962c595ee1b6a9391fe509ab38e7574202f94cda7da9f441c06fd5db5",
            "observation_ids": [
                "dfeea6ea4cb82cabd90aa8f1a3fa62068db5f63846b287f379189d5ab7be69dc"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "comodoca.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "1c5cf97fe6ac4ac6b506f33800e2b8f17e48e8560656ac00c04ae81bbf2fa297",
            "observation_ids": [
                "eaf480c2db932d3599611497c4bdb03623c4302a4cd8641d82e40ea0c1bc8f14"
            ],
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": "thea.ns.cloudflare.com",
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "c5cce1f4222e68060866b0d0c3f3bac20918460b9c12f4521229f995e3f492b6",
            "observation_ids": [
                "ebd67af0a0a30217eff5159a04df4666e6cbddb96074194da864865ce9461565"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "strict-origin-when-cross-origin"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "ae536ebe725e679d84e372cb0ccdbff1ec0f44c0816d63ee0fef09f1793c6ccb",
            "observation_ids": [
                "ef5c19d00e9792324d25702e7f705a61d0e076815faa063b4393d679082f2618"
            ],
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "excerpt": [
                "require-corp"
            ],
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "b6e518b345db7042821c72f0e5087203237ed8a995ffbe7d7f4b16f684131d62",
            "observation_ids": [
                "f489a968bc139417e564227641fb54b6cd347aebd97671a0f1412c313d386ee2"
            ],
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "sectigo.com"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        },
        {
            "id": "d3dbc9690edfe94fa2ace0868b6854f43b777a49c2e9ccb5755b2ff167708d59",
            "observation_ids": [
                "fe36983fb3249e350f07355b82e8b3f143ea84308748205089c63a9c3d754798"
            ],
            "evidence_type": "module_finding",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "excerpt": {
                "evidence": [
                    "Cloudflare"
                ],
                "severity": "high"
            },
            "first_seen_at": "2026-09-04T22:03:56+00:00",
            "last_seen_at": "2026-09-04T22:03:56+00:00"
        }
    ],
    "limitations": [
        "public_edge_does_not_reveal_origin",
        "provider_metadata_does_not_prove_processing_location",
        "pq_tls_client_not_enabled",
        "canary_detection_not_enabled"
    ],
    "evidence_qualification": "preuve technique horodatée et vérifiable",
    "sha256": "598d0f597fb1f8dc27ee9c64c2154aa978519fda6cb9ff2164d066ff5ce2e258"
}