{
    "export_type": "scanapse_public_evidence",
    "schema_version": "2.0",
    "engine_version": "2.9.2.1",
    "pattern_version": "2026.09.4",
    "scan_id": "a891f3b86bcf78717c2fc5dc",
    "domain": "quaric.org",
    "scanned_at": "2026-09-06T01:58:58+00:00",
    "evidence_count": 62,
    "evidence": [
        {
            "id": "57aad1a4a88fba45de43724d58fc31870caa27d4f7814912fab5b5b5baaba195",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "0113e7e91245a1dffc7eca1ac4ad8ca9b3009fa71f6967ae1826e02a76699c11"
            ],
            "excerpt": [
                "cloudflare"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "55ef9fa4999bad334a54f7ecbdbc9fdc50da62e176bed5c2387c51c1f1ed081a",
            "evidence_type": "dnssec_evidence",
            "collector": "dnssec_depth",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "02bf78f5c750b3df89299513fed622d4fa9561e7fd3dd2af824f121f4ce5ccd6"
            ],
            "excerpt": {
                "chain_consistency": {
                    "reason": "insufficient_record_evidence",
                    "state": "untested"
                },
                "dnskey": {
                    "query_supported": false,
                    "records": [],
                    "state": "untested"
                },
                "ds": {
                    "query_supported": false,
                    "records": [],
                    "state": "untested"
                },
                "validation": {
                    "reason": "no_validating_resolver",
                    "state": "untested"
                }
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "599a23590675dc4a31697bbb679dc2f1967ffc5042db812566b5e004b4da9c75",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "0398f1b20ab69f4efba6c03b63839c42476284cbfd78586379b667607c6abe94"
            ],
            "excerpt": [
                "default-src 'none'; script-src 'nonce-afVEBRXaqO8OXpNrYccORg==' 'strict-dynamic'; style-src 'self' 'nonce-afVEBRXaqO8OXpNrYccORg=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "a5bdaaf48de917917156556752d718fa8141901d5e660d6a51b329302d7d9514",
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "05ef64b9456272c7335a5aae2b8aff359bfeec651ccb3fbf2f0c5fb0c846f682"
            ],
            "excerpt": "lochlan.ns.cloudflare.com",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e335cf6879ae65078bdd1271fba6076100f3de3e390f97c4bdfbe1f2612b7dd8",
            "evidence_type": "technology",
            "collector": "technology",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "05f5df4ea158fb879628b56217dcd33b163b4adae79d329f7b6b7b4e4bbbe388"
            ],
            "excerpt": {
                "name": "cloudflare",
                "version": "",
                "version_exposed": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "31b3930e64d85ca9b6f4cbac6fc044c6bbc64435ae92999a6b280dd4ab22fdef",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "0e4349376400177a6119b9470b102f2a5f22c55582aedd48920344f28df34f2a"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "pki.goog; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "ace806a21cd6b676406503c8b8e5c1aa65c17278f7d768b28eccc9a64f0dd711",
            "evidence_type": "modern_transport_evidence",
            "collector": "modern_transport",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "1fb3bae9e7f32c7940d12ed0b3ca2c8a1173a3c2ba18ce0aafbfe5ccf02f8185"
            ],
            "excerpt": {
                "alpn": {
                    "state": "untested",
                    "value": ""
                },
                "certificate": {
                    "cipher": "",
                    "issuer": "C = US, O = Let's Encrypt, CN = YE2",
                    "protocol": "",
                    "san_count": 0,
                    "state": "observed",
                    "valid_from": "2026-07-22T02:33:06+00:00",
                    "valid_to": "2026-10-20T02:33:05+00:00"
                },
                "http2": {
                    "negotiated": "3",
                    "state": "untested"
                },
                "http3_advertised": {
                    "alt_svc": "h3=\":443\"; ma=86400",
                    "state": "observed"
                },
                "ipv4": {
                    "addresses": [
                        "104.21.6.240",
                        "172.67.135.121"
                    ],
                    "state": "observed"
                },
                "ipv6": {
                    "addresses": [
                        "2606:4700:3032::6815:6f0",
                        "2606:4700:3037::ac43:8779"
                    ],
                    "state": "observed"
                }
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "43afedb069af882bb41bed3277d080423f6f75b45e894666fd5aa917807a6656",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "269a793af2d83297564b8251b8ffddde1f01e4ea6590624a69e3bc5b5d3c7fcb"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "digicert.com; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "1f1d5c7f2f6110162452da2a2292b2da2428763a5f1bffb2518d7c18d21d494a",
            "evidence_type": "dmarc_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "29d8c4444b6cb2767848bca5997f16127f32f10fd7db89fae8d51ab4f4b0dd3e"
            ],
            "excerpt": "quarantine",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "42176c14d8d7f52539f2927eef6f3ea81ceb1ad4311d7ad83c911584d3517e8a",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "29dc836ef8e4842c284de7baab9493c308798e8f8fe00e828afbc3078f9e9cfa"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "ssl.com"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "c5d042a89a2e6f28831296b5c779d4d39615b0fb4649e1d7c729f841ef8e57ee",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "2a03cd3a21b438d9825a603f05963b010225f3d11706158899777d9ef7a30304"
            ],
            "excerpt": "2606:4700:3032::6815:6f0",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "ed74f622d6628b99a7138dc5c46b8dbe2382e2b56b8398ab08f41ad414de45b4",
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "2d5b0e678f3ddd6689e9722ec057ccba158fe1adc931ead8d26b62a2c7a13062"
            ],
            "excerpt": "kinsley.ns.cloudflare.com",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "d03e4514720d8f3526d6e8c2ab6850c78a91ac5077e530832fbaf506e3d15594",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "360b2c1b65a40e3f030bbaf7e84a30b6e10c7a872ddd9bed345adb0dfc71b168"
            ],
            "excerpt": [
                "max-age=63072000; includeSubDomains; preload"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "bb652a3dd9cf0505c360a61f7446456be06a4b6e97d43a2013b15162dad8588d",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3d1156f64c991a2e901f60728bfc2fdfa76a13bd1a26ff93a9685d7b4dac03f1"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "comodoca.com"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "7f593ab554380a051911f8ec30d701ba196b8f100e6c34f4585ce9e98d5a3311",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "457d2054006d494deb9456395a63e85f3d7ca7f5b250c8ddfb1f1b14cdb0f141"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "6987b9f10d386f65b7423bda86ce164480db7c2449e8c4ce79f8bbec0ae24668",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "4623313c6b63f64012aa38b7b895f0bd056f2b820f3cefb46026ec5ed5737cbc"
            ],
            "excerpt": [
                "require-corp"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "3fc9d422d060e23b4c25c806bd7cde5233306cc0cb57bf40e88dba813c0f43cc",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "50bbbf2c1aed922eb3e9b3e8763dee6757bffc8e04c3cb49171297616a526ec9"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "iodef",
                "value": "mailto:security@quaric.org"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "3afbc94d7e529655954931d6f8a5a21e786112d83efa469737b8b3a851e42ab2",
            "evidence_type": "post_quantum_tls",
            "collector": "pq_tls_probe",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "510cbd202e2edcf58057ed687492a9c13b8b57cbdce54f2ca6469227ae52ac7f"
            ],
            "excerpt": {
                "capability": {
                    "capable": false,
                    "groups": [],
                    "reason": "proc_open_unavailable"
                },
                "group": null,
                "reason": "client_capability_unavailable",
                "state": "untested"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "2410eac1dc42672e786b1f86e4e941fd17aa103910a23b126bcd4fefe61ea17b",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "607a7e448e33938708660b126cb7a928cff595773f288800291c13bf3ae4ce8d"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "mail.protonmail.ch"
                ],
                "id": "host-d87c7268dbc2",
                "known": false,
                "name": "mail.protonmail.ch",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "941fc40f7c9f0a37705dc88f11f36fb4b3d37052d8fea2884bbc8ff2f3c3ef7d",
            "evidence_type": "csp_evidence",
            "collector": "csp_depth",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6208b2d49270cc2a24d791bea48a8a836416c02c920cbe0d6bcbe00f74113d67"
            ],
            "excerpt": {
                "enforced": true,
                "frame_ancestors": true,
                "hash_present": false,
                "nonce_present": true,
                "object_src": false,
                "report_only": false,
                "reporting_endpoint": false,
                "state": "observed",
                "strict_dynamic": true,
                "trusted_types": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "539ee11c3d73fac8d1dac4ec3ff523941bacd1663f4fe3338ff1ebf25ac7e3a7",
            "evidence_type": "openpgp_discovery",
            "collector": "openpgp_discovery",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "64f220721d4e5ded019bd95eadd0bda2c185e05a665665c31ef3bfef64f125f1"
            ],
            "excerpt": {
                "dns_openpgpkey": {
                    "reason": "recipient_identity_required",
                    "state": "untested"
                },
                "fingerprint": null,
                "mechanisms": [
                    "https://quaric.org/assets/koperateur-pubkey.asc"
                ],
                "reason": "security_txt_encryption_observed",
                "state": "observed",
                "wkd": {
                    "reason": "wkd_not_fetched_without_identity",
                    "state": "untested"
                }
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "5b9836e7ecf8959e39e4e251fa8d2721a8311e80ce12fe620d56ce6f685c529f",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "66858d13cb601a3667c73f103f1e8470c571504946b7738779bfc7e31061c14c"
            ],
            "excerpt": [
                "same-origin"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "8a723f17a5d9501dcb737e510043356249ef117f39c7fa046a816e19396eefde",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "673f09429105ccd7cd889953d5136977c5c33fcb318b0d176772e3b2f8700140"
            ],
            "excerpt": [
                "same-origin"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "f419b192ef165cfe5faa25c8df250113fb2d01c0ecf09190ed1c5c45c4561ba8",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "68a55618195059de09754f8abb3dbf7fd2b1db97d815e80fc422ae1bbfde04d6"
            ],
            "excerpt": [
                "nosniff"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "032417bf1fe16ba08f844286c8e20d774d7252bcf50fd929ada69cf498dfddaf",
            "evidence_type": "spf_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6a66586bf50f65e882b461052277e6af89789574b7ee73cab01eca4d6d85170b"
            ],
            "excerpt": "v=spf1 include:_spf.protonmail.ch ~all",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "5ac9af3008aee7252e368d0c98c75d147994b95f72a2834a8f6995a3a75bf4b5",
            "evidence_type": "canary_signal",
            "collector": "canary_passive",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6df22f638e7c441fa9c9782b0aba695341f84268b50ddf03f7469c6eb24c0706"
            ],
            "excerpt": {
                "matches": [
                    {
                        "name": "canary_field",
                        "source": "security_txt"
                    }
                ],
                "reason": "known_passive_signature_observed",
                "signature_version": "2026.09.1",
                "state": "observed"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "0311e77a94e31ccdf10b1c72e20c1da92ffc8e2d95f74a77f6ae9d3c53343c33",
            "evidence_type": "module_finding",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6e1dabe2edf213c52f87d0c993e8541d0eb3d3d915cf9251f3844f69a916552e"
            ],
            "excerpt": {
                "evidence": [
                    "0bla.com",
                    "mail.protonmail.ch",
                    "mailsec.protonmail.ch",
                    "static.cloudflareinsights.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "38080fffafccb8028ad5f608e5bb90234e80bb38693da5df562954873de308a9",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6ea5f0ff9c1cb0c1125615ca1114789202db75ba797f619bb2acee8a4075e510"
            ],
            "excerpt": "172.67.135.121",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "2cc1ace1e7542746d11afdbe7c38e268bedd676983ef914956c073f434c3eaa3",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "74bf0f5ef2bf2ef4d938d5585da9155d62d2ca7632f4e4bb7b08be29f7701523"
            ],
            "excerpt": {
                "evidence": {
                    "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
                    "status": "not_tested"
                },
                "severity": "info"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "8e0c2066bd0ca3b2c1a724c56ce8f947e15ac28e042a032a10b663eb1efc8993",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "77521bf097a804b18ad6a9ba459641074dc3b729923931ed3bea60033b6801ad"
            ],
            "excerpt": [
                "strict-origin-when-cross-origin"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "8daf20b5918a68496c669c68a694d32a26c662f0ac8402c1ed09d5dad46111d2",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7a0d2e642c174a404f65db4b7803bd5e6fedcc3417d3f9ab17f45203e05b55c3"
            ],
            "excerpt": [
                "DENY"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "75a55965f5d8c4116f48e399bf46fcd026aff87289351432ef4a10286820f911",
            "evidence_type": "tls_valid_to",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7d9ee3f0f9c7c089f9d70842e8ffa380589696db690a37f0bf0ce6280784b870"
            ],
            "excerpt": "2026-10-20T02:33:05+00:00",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "bc75c474b16c72c5345f67da52e8b4175a7af3c271bd4c8ef2bd968544207fac",
            "evidence_type": "tracker_provider",
            "collector": "privacy",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "878b374e08a5a3a97e86cd6a551f31ef3de7abf0fe369399260c0d2420dace17"
            ],
            "excerpt": "LinkedIn",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "310be4a06eec394cc123749cf3d92be973d817624bf8bcd8239ba5a1d074213a",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "8e9cd26d1a82d27356df016f0baf6fcaa8de5f93da77a7aebc1f211777d25b2b"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "static.cloudflareinsights.com"
                ],
                "id": "host-d15afad5fd0c",
                "known": false,
                "name": "static.cloudflareinsights.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "b50de5e622559b2b101766602f67c59e67a9402265b8deae875cbf687901cade",
            "evidence_type": "module_finding",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "8f43590be12eb0ef31e3601fbaf0373f817c4903ae45e9ff805d190b18dbd250"
            ],
            "excerpt": {
                "evidence": [
                    "Cloudflare",
                    "LinkedIn"
                ],
                "severity": "high"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "783549f369748dea7e9fdf5da3531321e07fdede0d39b6dffe5c746c07cda621",
            "evidence_type": "cookie",
            "collector": "privacy",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "92155c96a9dc4ad038853746b05711b5bc6de30bf18c4193de3e4196d745cf88"
            ],
            "excerpt": {
                "http_only": true,
                "name": "quaric_lang",
                "same_site": "strict",
                "secure": true
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "6038adb4d86f995624d947416c460b4cbe27a4381ac61be6de7d41cbc1518110",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "92e44c146ad703d23efb6a1cafe1bb74d0b1b98976912dccbae5e92b54ea795d"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "ssl.com"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "d63c06e93dd3da43ac36a7c191a094dbf82893dc96cbb459ddb998d4d8c55e99",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "9d46c5819b86b784fc136cf291c82c4d3dbe7d52af58621914caaa7b6357ef97"
            ],
            "excerpt": "mail.protonmail.ch",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "66fb7eb90179bcb215a2aa6719176e4d0cc48744b2441be41cd31e7a7d1cee27",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a2e215e28e5d95df03471a661a127c4e9700b608a46cc1a2ab767e31d6eed606"
            ],
            "excerpt": [
                "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
            ],
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "b266261606fc4fb730ec34aa349a5d755f26bad5465688c89cb8c9b9fb83b931",
            "evidence_type": "module_finding",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a454d27e71e32240058523ff806676f6cd967389cf9842517baee92a4aa9bb78"
            ],
            "excerpt": {
                "evidence": [
                    "kinsley.ns.cloudflare.com",
                    "lochlan.ns.cloudflare.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "bd029a386f383e52be11ddaeaf2aa847bad313d1ef958e512bca1c8f46b2807b",
            "evidence_type": "spf_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "aa23c976ce8e25f8ca462a90d0cd84ca5ec5d7002d15fd5ae921cdfd19617ee0"
            ],
            "excerpt": "softfail",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "1ebea9a82118a5ce82628954e746d84aacf7786911ce39d13077d70fb3ced239",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "b2c51de059b62cbd8d72ea9c679564c53c50b4a28cc2700250734ed069d52d87"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "digicert.com; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "7f56a1830d71ed6f0bfd37d89d328a39042374a4b4501ddbd2ece7469ecf5e1c",
            "evidence_type": "mail_transport_evidence",
            "collector": "mail_transport",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "ba286cf7124ca22ba9299529c0e5ced1346067842852b5888a7de77ff83567b6"
            ],
            "excerpt": {
                "bimi": {
                    "records": [],
                    "state": "not_observed"
                },
                "dane_tlsa": {
                    "query_supported": false,
                    "reason": "tlsa_query_not_available",
                    "records": [],
                    "state": "untested"
                },
                "dkim": {
                    "reason": "no_selector_bruteforce",
                    "state": "untested"
                },
                "mta_sts": {
                    "policy": {
                        "max_age": "604800",
                        "mode": "enforce",
                        "mx": [
                            "*.protonmail.ch",
                            "mail.protonmail.ch",
                            "mailsec.protonmail.ch"
                        ],
                        "version": "STSv1"
                    },
                    "policy_state": "observed",
                    "records": [
                        "v=STSv1; id=202605032030"
                    ],
                    "state": "observed"
                },
                "tls_rpt": {
                    "records": [
                        "v=TLSRPTv1; rua=mailto:dpo@quaric.org"
                    ],
                    "state": "observed"
                }
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e9bf6ed5dceacb82e9f1e3f4cecbfdee0b9f4849a09e80bd7818ea719eb0660d",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c0644485290bcc46aa27967515cf7cb2261cc07d231ae60273c6d4548a37e30f"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "0bla.com"
                ],
                "id": "host-d60d939674d6",
                "known": false,
                "name": "0bla.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "4188992e189503d1f3ca892df018c67f3d26952f393b02c38c52fc457ad34b97",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c55f7bf9923aeb1711002e139eb13c8f0fb464a8ac179a2933129883dc79688e"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issuewild",
                "value": "letsencrypt.org"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "c6d262349d04485cbf3f761648bf33aa6cc7c913acab627ffeb488c647db6c9c",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "cbf91806041f41848a6edc7da2ce03df566e79f6bea7d0ce304faf6ce4b9390a"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "comodoca.com"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "8ade5af8fd0ad8bcfa31dedb8f3b3c8fd0e65823d047458ef3de48bb18ded493",
            "evidence_type": "dmarc_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "ce7de0433209126722e8e43be2cc7af2529e26b2afe84f75e1c3e883ad696ebe"
            ],
            "excerpt": "v=DMARC1; p=quarantine; sp=quarantine; adkim=s; aspf=s; pct=100; rua=mailto:dpo@quaric.org; ruf=mailto:dpo@quaric.org; fo=1; ri=86400",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e2164db8e5e19b66aabd6f86d08be14853643566218743ff0eb3b6663289b060",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "cf5562c00417537dc7d1e21dab76019def5fbccafc9c4dcd93ee5a8950749677"
            ],
            "excerpt": "104.21.6.240",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "2537091bb3acaa61f675d5e3c8d461d56293217ea69c9d0541239d84cbe3fe2f",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "d12ecf5aac413511b04951354458ca92d27cdb2586fa618978c7481a3c9c1399"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "www.linkedin.com"
                ],
                "id": "linkedin",
                "known": true,
                "name": "LinkedIn",
                "observation_count": 1,
                "services": [
                    "advertising",
                    "social"
                ],
                "tracker": true
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "61363889297bbeb4c3eab1879f955530dfd9336a02685ae91d4fb991f6de27be",
            "evidence_type": "module_finding",
            "collector": "privacy",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "d78ced672acd6cc13abd41f32581e4eadcfe1e5c595abc7a64601a57ec0f2111"
            ],
            "excerpt": {
                "evidence": [
                    "LinkedIn"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "a0d27d77cdcaea0adfaf0c4afb3eb05d65e3cc4a1f56e4cee620e2f412322755",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "d990bf826d2b352e3769f8661fe74b1bb8c2204eb90105e979dbc8fef7f4a233"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "mailsec.protonmail.ch"
                ],
                "id": "host-795bfed2e90f",
                "known": false,
                "name": "mailsec.protonmail.ch",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "68a98840f5138ee57f48cc4f6a7ce6fea46efd7a226f6bff0de02af2a01ff86d",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "da8bd09184e3521e4ffd7fe789834a763166812c69f1d7b58dc6adab433a8b32"
            ],
            "excerpt": {
                "evidence": [
                    "kinsley.ns.cloudflare.com",
                    "lochlan.ns.cloudflare.com"
                ],
                "severity": "low"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "13b5a8050693a251a402c202f9cda0a977db996e8704e9f0f1c321c96759b9b0",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "dde58bb1f979fd00ad66d630cfe1883b527b6ea038f3f8b75a10d581d9565fdd"
            ],
            "excerpt": true,
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "199323c393970a60f6c0bc8fd5f11f5bb32acf421d4a6c17805ab1e5a223cfaf",
            "evidence_type": "module_finding",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "de2b1ed23a6d7ab3fcb8ec7f10227734b9d0fe3e7e2c9c67ab04d468bce043b6"
            ],
            "excerpt": {
                "evidence": [
                    "0bla.com",
                    "Cloudflare",
                    "LinkedIn",
                    "mail.protonmail.ch",
                    "mailsec.protonmail.ch",
                    "static.cloudflareinsights.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "19630cbd19863b675e62956d5620431382426c727f318ed337d946a70b9fda82",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "e51709e2e6ef088aa34dc422b3870c55c2e7e74f435c227c1f367ae4d5067a23"
            ],
            "excerpt": "2606:4700:3037::ac43:8779",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e1837e1ab7abc9b1ab5444c7c37ac3a21faff97da1684e9c985b79626d6f3c40",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "e8ec783ac149bec790f2cd92727d114934ea18c066a7a445e33471a27d55c518"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "letsencrypt.org"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e8001318f27a4be64973a88bc3cf352a8c486ea85b60e3976f23134dcc133c01",
            "evidence_type": "tls_issuer",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "f26a69ae7e30f1feb938c17b62b6274e114b5d80a1032ca75fe9b62f3593af6c"
            ],
            "excerpt": "C = US, O = Let's Encrypt, CN = YE2",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "2e914e199c7acea361d4a7b700484aa209c75ebccab3a3ae9ea0b6689550aae9",
            "evidence_type": "caa_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "f28e592ddb2e60155460ddc9304bd6adc7d13e79efb23fc534883d2de981a5c7"
            ],
            "excerpt": {
                "flags": 0,
                "tag": "issue",
                "value": "pki.goog; cansignhttpexchanges=yes"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e572a630ab65d0500bc0d9927be87d12edc0506640443a69891ad3af6b6c52f3",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "f8a44369e5718174a8e110ecfa1b67dbbea6e12c1f57fdb5acc036cd28d21aa6"
            ],
            "excerpt": "mailsec.protonmail.ch",
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "e19e0b0f292f89d76219cd917109394b962a6c08ae17d44dd2d7182fe44af5c6",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "fb9e55ea277e5f0ec8ae19c0437a36de9a4373bcfffb2aaff419fa0b32f782e5"
            ],
            "excerpt": {
                "critical": true,
                "hosts": [
                    "cloudflare.com",
                    "kinsley.ns.cloudflare.com",
                    "lochlan.ns.cloudflare.com"
                ],
                "id": "cloudflare",
                "known": true,
                "name": "Cloudflare",
                "observation_count": 3,
                "services": [
                    "cdn",
                    "security"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "073967e288f35d43a91cfdf2ed4c87309eea2e9561d9aa2313c56a1d5981956e",
            "evidence_type": "module_finding",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "fd99a195a607d83e2e0dd80cb0d713c8c13b3e7c951c84ce4bde1f5dfc129567"
            ],
            "excerpt": {
                "evidence": [
                    "0bla.com",
                    "mail.protonmail.ch",
                    "mailsec.protonmail.ch",
                    "static.cloudflareinsights.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        },
        {
            "id": "9afc0e70b44bfeb024b1a8758789f1bb94a381c6e4237588345153e35e85015e",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "ff9d2f5e56b67cc236b7dba3dfb67ff9abd171b52c1344ee05f62eb5fd710b2c"
            ],
            "excerpt": true,
            "first_seen_at": "2026-09-06T01:58:58+00:00",
            "last_seen_at": "2026-09-06T01:58:58+00:00"
        }
    ],
    "methodology": {
        "model": "evidence_first",
        "version": "2.3.1",
        "principles": [
            "absence_of_evidence_is_not_evidence_of_absence",
            "unknown_remains_unknown",
            "provider_metadata_is_not_data_location",
            "edge_provider_is_not_origin_host",
            "single_snapshot_does_not_prove_resilience"
        ]
    }
}