{
    "export_type": "scanapse_public_evidence",
    "schema_version": "2.0",
    "engine_version": "2.5.1",
    "pattern_version": "2026.09.4",
    "scan_id": "31c5e2fa5c6840d9874144fd",
    "domain": "koperateur.com",
    "scanned_at": "2026-09-04T12:36:40+00:00",
    "evidence_count": 41,
    "evidence": [
        {
            "id": "9e522881db02d698a81feca18e41ef7f5f10553fcd84ac006825b66d47bb487d",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "0aaeeb34a50afb0337978f150e81b4a3a5c794259604e062f5a66a3640f6703c"
            ],
            "excerpt": [
                "DENY"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "e96a5f0706b6aa901fb6e64e944d8f4977fa9563f2ac16536a58d8e10f216593",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "12122f28da50bca98b94c0a968c45b9f9cf2d1a68eb13387b650dfcb80596519"
            ],
            "excerpt": [
                "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "e2e3d580bb168e0a5d1adeda32b5076552f09ad33858fdcaf9a88d90cf284115",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "147cec655efe8198783c12f714c8db635fba34c2d09231fb1a194329b73cd33e"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "e88b9310b49920cba6ec60661d60eaab0d9f6dd8446ab425d67fecb59a9c98ca",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "153959bb8517f4787abd9a97d44759adeec1183ea2aa5524b61768edb4691e5b"
            ],
            "excerpt": [
                "cloudflare"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "327333cf78a603d15b5747716c324b5d3a5235eb966e0f4a86850fdf32401161",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "23d0240ab2f025523b620c19cafc959e28d45f398420febf36f9a04ca018b930"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "mail.protonmail.ch"
                ],
                "id": "host-d87c7268dbc2",
                "known": false,
                "name": "mail.protonmail.ch",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "fa4ba54f253ce0c8b0d41a4646e96707f171d3eb93807f73442b074098a9075d",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "26adaa68ad9bdd57270ff7da4294f50eed8a86f07fc89b7094817d79c9130ef3"
            ],
            "excerpt": [
                "same-origin"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "fc831c1e4054fedbf8729bb19082508f4e0c5774a8ea9c7a283d36a8088622d3",
            "evidence_type": "dmarc_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "2cd8527f1c7ee423f3400700e87f89b8b0175740c8e105f52ce1217121500ff7"
            ],
            "excerpt": "quarantine",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "47931ebf44efdadbd76a3e50c2cd7cc5d1eca481fd4daced04363885fb6f9fdf",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "2f4fd943c7dedd4060f7c342d8fc0c42a388ac891ae388c4b6094e267d40250a"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "9e696184e69f243b0530c8cda73b5248f862c2642d023a90cc51a59621bb43cf",
            "evidence_type": "tls_valid_to",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3288678d34277d0cf973d1633d62ff9a6b376fd3143407637df4f9aa02d9084a"
            ],
            "excerpt": "2026-11-14T18:09:19+00:00",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "cfe5c446492810f8aa27417f3a4f89c42983e0e6924f6a4392f9b78e3a1e7cac",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3b0064d4294ebb03ac9e7281c1605f23fd919d52caca39cbc5c45d2b856311df"
            ],
            "excerpt": {
                "critical": true,
                "hosts": [
                    "cloudflare.com",
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "id": "cloudflare",
                "known": true,
                "name": "Cloudflare",
                "observation_count": 3,
                "services": [
                    "cdn",
                    "security"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "20d02003850a7f7a66ed835cfc35a1a7254d1a53dfcb8f9931fb482241a25a46",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3e6687ef1582879be16cc6981d6a93f7a40d8892e985e75fad91d0c83abd1d7c"
            ],
            "excerpt": "172.67.182.192",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "f8ee1ee15b6a6d63c30edd1c010f032b335573d749b9a96a984b06a3047ad101",
            "evidence_type": "dmarc_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3fbedc4f52fe0fff38fcef25ed37b9df39be1d6ea73ce983884e2ef7a3230d09"
            ],
            "excerpt": "v=DMARC1; p=quarantine",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "bed6ce4662d60187ce4d027423d7d4841dc87ed606920fc795a8f6ded1cb8633",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "4198be99a22412819d63f1db861078e3cb51025634712068c54ef2794e8a8bf4"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "601673b6035e77d795d4f1f09f7a86064b45a2a3f197b912893e326d8dee5fdb",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "45a2fff912dc3e36ddf5fa5ad0993492212cc538f19130ee50b2bf5266cb57af"
            ],
            "excerpt": "2606:4700:3032::6815:12a6",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "180db483b973a3d95ba0f441c66d3e66ebde4336b9f7a55953a7c79746eb4ccd",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "4a56fa08f54258c292f83b3c71e7d5ea68435a144189ebd5bb7f217edcfab917"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "be11843b5f75867a76573afb80f207f7e5ce864fd841bb3f1dc049db70c6db65",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "5314bf6fe1b9e2c4f81fe81b4f48aff3aacadf166bc87e7b9491bfff629db293"
            ],
            "excerpt": [
                "nosniff"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "807735673bc55952f1edace58ef00a9249092202535cdc8077c2c01a8a2e7583",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "62d07c27fd88e1c4e5e9ff418aa31c4f2449c7ea5d8af0da8de6bbefb21284ae"
            ],
            "excerpt": "104.21.18.166",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "c0ce6bc3d8a83f2280fcfdcbaec9a1795da3f57e5db1e44c5dfb0dd15f66b3a3",
            "evidence_type": "module_finding",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "65460c3298211277c41cf40a522249a1b521d72fa4a9fbfda820824cee47e213"
            ],
            "excerpt": {
                "evidence": [
                    "mail.protonmail.ch",
                    "mailsec.protonmail.ch"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "30d41cdcd4587277c7bdd8bc2ff44332d5b0d07bbbe3c9d4ebe4a08652957508",
            "evidence_type": "technology",
            "collector": "technology",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7379d30e396b53cd6b432240b7f216d43e356f3fe851319869c384977256c934"
            ],
            "excerpt": {
                "name": "cloudflare",
                "version": "",
                "version_exposed": false
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "9df779d617943404989ef568bf16965595d2169fb366987b5e1187bf3ac50979",
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "73e18ac556ef9cebd5dc19cad1eccc2927952716464b8529bbadda252106a554"
            ],
            "excerpt": "thea.ns.cloudflare.com",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "6ec3200db21f245623cfbb911d69707f72435d417c3eca1c354225efbdc3247e",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "74b317134bb05e2b631f8f80ba18762a8f39c68ca39671638e5da62474336991"
            ],
            "excerpt": [
                "strict-origin-when-cross-origin"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "4a2551ad69ebd25a0b78b4450a9b016824481f5987de07ffdec66c01e2c6ff74",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7667709d5acd0aaeb928a7b9efb17dd871c832715fbb4fecd221d85b65ccf7b8"
            ],
            "excerpt": "2606:4700:3031::ac43:b6c0",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "11bfb3e74a62ef368ad26a89eb7ea3540e5d0a67f8f341ed996e3dbd58f751a2",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7ad34b6dc95a3dd4ad536df97358b3970426d5053a86de5f56f29a7fe93f6d84"
            ],
            "excerpt": [
                "max-age=63072000; includeSubDomains; preload"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "e3b33a865092e51e2a5b6d7a2f6d0bedf6ffd82b3ba5d610bf7199df76b28f5d",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "84bae46b30b2c6ff4f28fee83febd9c68b2e645d9d512346a62024d4ef1fd8c7"
            ],
            "excerpt": {
                "evidence": {
                    "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
                    "status": "not_tested"
                },
                "severity": "info"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "56ef91218f9301d9daea6f4cc3a197d8176fc1acf12ee30cf118c05c75142310",
            "evidence_type": "spf_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "888e3b22ce835091be2cdc7e1eeefe8fdcaa73253c8c6db0a5ef65e959c844b1"
            ],
            "excerpt": "v=spf1 include:_spf.protonmail.ch ~all",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "e43d9458950959cbd9bf0cdec69c675b3e5267fada052531b1669926de849dbf",
            "evidence_type": "module_finding",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "8fddb7d2d3b22b811d765804c8c0ac7005368993d4f3fc1e7bc542c7557511db"
            ],
            "excerpt": {
                "evidence": [
                    "mail.protonmail.ch",
                    "mailsec.protonmail.ch"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "4ac2335f6f0140d4ba2c2764678bf6d7aab2aea4bd32842fda118fcab90b4c53",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "973030585e95ee113159492205fa962c124149682a5e5ee15e25981ded21d8f2"
            ],
            "excerpt": [
                "require-corp"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "e529b11141a57da498701c2ae23a1b7335b2ee8846cdabb03e9e360c6ce57f09",
            "evidence_type": "cookie",
            "collector": "privacy",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "9a5d77c9478462279ba8106328aec7a2f6c4e8aed1b92f02261406462df3a00b"
            ],
            "excerpt": {
                "http_only": true,
                "name": "kop_lang",
                "same_site": "strict",
                "secure": true
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "586cc29afd1d2f565bda2ee06546b6ada9eb19e69a15d024ef484abd8094cac4",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a4dfb5f1e56ede6310d5221839f026cb442fab9bc8562f468c03aef223894ccc"
            ],
            "excerpt": "mailsec.protonmail.ch",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "9846a919ebe56476ee6a67844a56486f2d3de8cc3a25b7cb3d812fbea497de5a",
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "bc3e9c26724c08a7280d88371e163cee489184e5d58c646ab217ced74f56e392"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "3d89728a0b9250859c5e9226996521679ddee416c80075e43c2f5392a276a166",
            "evidence_type": "tls_issuer",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "beb2be6aded1248d95cead6b502a950e79ed3b1ec23105bec8e8a4a4eb8929fb"
            ],
            "excerpt": "C = US, O = Let's Encrypt, CN = YE2",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "90210d8dc4e84b0eef6614179f1493f3ba80d0293e87a2975267c0d40dbc1152",
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c40acf1b1b2a81da77ff2ae215fb0c61783b0178af7ba2dd84262f8b8a57a15c"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "2eee442974fd20f86510dfe3b97b543650318e967e3998e0c3d5e3dbb78f4799",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c82ed014f4a15c9a3082b877cfb9963b11c383d4adaf0fdfa543820582a3f486"
            ],
            "excerpt": [
                "same-origin"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "101442bcbb655db69755c542ecd1d9f2a5615c5f5648ca6062af8e0c3bc9a27f",
            "evidence_type": "module_finding",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c8bc92a8d560b04b9be4be8009fc1ecdf5eb08869269ea805f3457633e9187cd"
            ],
            "excerpt": {
                "evidence": [
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "cd16e7c5c8949377bd252fd8c88995166259b718fece3834353b91c7fb02df40",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "d376ffa507c24143874dfe818ed66ddbfa5c6a74f283bc77164ec4fdacdd01f7"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "mailsec.protonmail.ch"
                ],
                "id": "host-795bfed2e90f",
                "known": false,
                "name": "mailsec.protonmail.ch",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "8995de9ec6179be245ad10a991140c34a8022cb0e4692266d5b384411a9b531d",
            "evidence_type": "spf_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "dacdfe0977167e70f3a96c694c9844d23366765862a70a672c3b1576d4cd6603"
            ],
            "excerpt": "softfail",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "47ad219f7e6763d2f460d0a4ab10401ee3e295a2ad4b6dc30484daeb52e0ec4f",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "dadeca8c6bc1ea9d7618bfe70b9fbc96764c4dd7d79185d7ae4f07b9712b264b"
            ],
            "excerpt": "mail.protonmail.ch",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "0c5dc11a182892af697bdf0ed6ed8d615ac52c424a30c78638b9a5de1d28d832",
            "evidence_type": "module_finding",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "e27f49918cc375af20096928e62c0faa63f78c4b6139633bafa642d7c4b580de"
            ],
            "excerpt": {
                "evidence": [
                    "Cloudflare"
                ],
                "severity": "high"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "864c5a1c7cd3c379c20194695a937b5d758013649a650b9099bfa2e7c018ad26",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "e7852629fc87307c18a1ded64dea314b571b80196b10b81399cb187e8c31664c"
            ],
            "excerpt": {
                "evidence": [
                    "david.ns.cloudflare.com",
                    "thea.ns.cloudflare.com"
                ],
                "severity": "low"
            },
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "9cc6396ee04b23b878b70e6b17fb77db3382d14015a14224d4b80e7f0e89736f",
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "ef92d3136c728887e25dd8dd66cb63b313548943d4ad4ccfd80875197896b524"
            ],
            "excerpt": "david.ns.cloudflare.com",
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        },
        {
            "id": "909644e7437c6dc1c5ef5990ee8b9c53f15183d9f033d70b18d7aa41fc1b063b",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "fbd1c2f2c5068b7d789a75ec52ae80341dc128e143443f38b4474787281cbcdb"
            ],
            "excerpt": [
                "default-src 'none'; script-src 'nonce-miFD3pcpAp7z6uLYfNQVbg==' 'strict-dynamic'; style-src 'self' 'nonce-miFD3pcpAp7z6uLYfNQVbg=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
            ],
            "first_seen_at": "2026-09-04T12:36:40+00:00",
            "last_seen_at": "2026-09-04T12:36:40+00:00"
        }
    ],
    "methodology": {
        "model": "evidence_first",
        "version": "2.3.1",
        "principles": [
            "absence_of_evidence_is_not_evidence_of_absence",
            "unknown_remains_unknown",
            "provider_metadata_is_not_data_location",
            "edge_provider_is_not_origin_host",
            "single_snapshot_does_not_prove_resilience"
        ]
    }
}